CVE-2026-99181

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> autofs: ignore notification errors from a replaced pipe<br /> <br /> autofs_notify_daemon() takes a reference to the current notification<br /> pipe under wq_mutex, then drops the mutex before writing the request. The<br /> write can block while the daemon enters catatonic mode and installs a<br /> replacement pipe.<br /> <br /> If the old pipe&amp;#39;s reader is then closed, the delayed write returns -EPIPE<br /> and the generic error path enters catatonic mode again. That transition<br /> acts on the current superblock state, closes the replacement pipe, and<br /> releases the new daemon generation&amp;#39;s wait queues.<br /> <br /> Only enter catatonic mode when the pipe which failed is still the current<br /> pipe. Factor the already-locked transition so the identity check and state<br /> change are atomic with respect to another replacement.<br /> <br /> This was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest.<br /> An unprivileged UID 65534 lookup filled the old packet pipe before a<br /> normal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe<br /> received HUP and both a pending victim lookup and a later lookup failed<br /> with ENOENT in two out of two fresh-mount runs.<br /> <br /> With this change, the new pipe remained active, received an intact<br /> 304-byte request, and both victim lookups completed in two out of two<br /> runs. Normal lookup and restart-without-a-blocked-writer controls passed.<br /> No KASAN, oops, refcount, or lock diagnostic was observed. A source<br /> reproducer and complete local logs are available privately on request.<br /> <br /> The demonstrated impact is limited to denial of a shared autofs service<br /> during a legitimate daemon restart. No memory corruption, information leak,<br /> privilege escalation, or code execution primitive was observed.