SB20261029129 - Race condition in Linux kernel autofs

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-99181)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service in a shared autofs service during a legitimate daemon restart.

The vulnerability exists due to a race condition in autofs_notify_daemon() in fs/autofs/waitq.c when handling notification write errors after the daemon replaces its notification pipe. A local user can trigger lookups that fill the old notification pipe and block a write across a legitimate daemon restart to cause a denial of service: a delayed -EPIPE error from the old pipe triggers catatonic mode against the current superblock state, closing the replacement pipe and releasing the new daemon's wait queues.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1a177064f501ed4b67873a43aae5d5bdb18b3704
• https://git.kernel.org/stable/c/65676cd4203c0e41a94caf54080a7f0a95434bda
• https://git.kernel.org/stable/c/fb296391f685d82dbb93621a970fb234cea45280