Search

CVE-2026-89767 - ovl: fix double end_creating() on the casefold-mismatch path

CVE ID : CVE-2026-89767 Published : Sept. 11, 2026, 8:20 p. m. • 32 minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mismatch path ovl_create_real() releases the new dentry twice when the casefold consistency check fails. The S_IFDIR branch calls end_creating() and sets err, then falls through to the common out: label which calls end_creating() on the same dentry again: case S_IFDIR: newdentry = ovl_do_mkdir(ofs, dir, newdentry, attr-mode); err = PTR_ERR_OR_ZERO(newdentry); if (! err && ofs-casefold ! = ovl_dentry_casefolded(newdentry)) { pr_warn_ratelimited(...) ; end_creating(newdentry); /* first */ err = -EINVAL; } break; ... if (err) goto out; ... out: if (err) { end_creating(newdentry); /* second, same dentry */ return ERR_PTR(err); }