Race condition in Linux kernel - CVE-2026-99181
Published: October 29, 2026
Vulnerability identifier: #VU158409
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99181
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service in a shared autofs service during a legitimate daemon restart.
The vulnerability exists due to a race condition in autofs_notify_daemon() in fs/autofs/waitq.c when handling notification write errors after the daemon replaces its notification pipe. A local user can trigger lookups that fill the old notification pipe and block a write across a legitimate daemon restart to cause a denial of service: a delayed -EPIPE error from the old pipe triggers catatonic mode against the current superblock state, closing the replacement pipe and releasing the new daemon's wait queues.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99181
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2