Use-after-free in Linux kernel - CVE-2026-99180

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel Unicode map handling used by generic_ci_d_hash() and generic_ci_d_compare() when RCU-mode pathname lookups race with filesystem teardown. A local user can race a pathname lookup against release of the last reference to a casefolded filesystem mount outside the normal unmount path to trigger access to a freed Unicode map and potentially crash the kernel.

Affected software

How to mitigate CVE-2026-99180

External References

• https://git.kernel.org/stable/c/2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8
• https://git.kernel.org/stable/c/6560c3d9a6925e3747d9ad8463e16010c31ba715
• https://git.kernel.org/stable/c/a96c5299bd7305eb984377681eb3222a57376405

Related Security Bulletins

• Use-after-free in Linux kernel Unicode map lifetime handling in fs/unicode/utf8-core.c, used by generic_ci_d_hash() and generic_ci_d_compare()
• Debian update for linux