SB2026091220 - Double free in Linux kernel overlayfs

Description

This security bulletin contains information about 1 vulnerability.

1) Double free (CVE-ID: CVE-2026-89767)

CWE-ID: CWE-415 - Double Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a double release in ovl_create_real() in OverlayFS when handling a casefold mismatch during directory creation. A local user can mark the internal work subdirectory as casefolded after mounting an overlay filesystem and trigger a directory copy-up to cause a denial of service.

Subsequent creation operations under the affected parent directory can block indefinitely on its i_rwsem.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/077ab8985ee278c3d8618182d335b0f0cd919e16
• https://git.kernel.org/stable/c/2fa220bc0f84597cb6de665e5b5021c5901ddf00
• https://git.kernel.org/stable/c/b1aa8ab78a8e87aee9e306971465408e059f839a