Executive brief
A bug in the Linux kernel's overlayfs filesystem layer causes a deadlock when copying up directories on systems with casefold-enabled storage. An unprivileged user can trigger this by creating directories in an overlayfs mount after marking the work directory as casefolded, which causes the system to lock up and prevent further directory creation operations.
Technical details
The vulnerability is a use-after-free / double-unlock bug in ovl_create_real() where the function calls end_creating() twice on the same dentry when a casefold consistency check fails in the S_IFDIR branch. The first call occurs at the casefold mismatch check, and the second call happens at the error cleanup label, resulting in a double unlock of the parent directory's i_rwsem (semaphore) and double-dput of the dentry reference. This causes subsequent directory operations to deadlock on the parent's inode lock. The vulnerability is reachable by unprivileged users because the internal "work" subdirectory is not re-validated for casefold consistency after mount-time checks, allowing attackers to mark it casefolded and trigger the bug path through ovl_start_creating_temp().
Affected products
- Linux Linux kernel 2.6+ (overlayfs introduced)
Timeline
- 2026-09-11: disclosed