VulnerabilityPublished 28 Oct 2026

CVE-2026-99181: Linux kernel · autofs: ignore notification errors from a replaced pipe

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fb296391f685d82dbb93621a970fb234cea45280 : update Linux kernel when convenient.

Data as of 28 Oct 2026, 10:58 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

Patch: Available – fixed in fb296391f685d82dbb93621a970fb234cea45280, 65676cd4203c0e41a94caf54080a7f0a95434bda, 1a177064f501ed4b67873a43aae5d5bdb18b3704

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to fb296391f685d82dbb93621a970fb234cea45280, 65676cd4203c0e41a94caf54080a7f0a95434bda or 1a177064f501ed4b67873a43aae5d5bdb18b3704.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e, < fb296391f685d82dbb93621a970fb234cea45280	Fixed in fb296391f685d82dbb93621a970fb234cea45280
LinuxLinux	Affected ≥ 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e, < 65676cd4203c0e41a94caf54080a7f0a95434bda	Fixed in 65676cd4203c0e41a94caf54080a7f0a95434bda
LinuxLinux	Affected ≥ 8d7b48e0bc5fa01a818eac713d4cb0763090cd0e, < 1a177064f501ed4b67873a43aae5d5bdb18b3704	Fixed in 1a177064f501ed4b67873a43aae5d5bdb18b3704
LinuxLinux	Affected =2.6.28	Fixed in–
Red Hatredhat/kernel`pkg:rpm/redhat/kernel`Other threats	Affected =2.6.28	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofs_notify_daemon() takes a reference to the current notification pipe under wq_mutex, then drops the mutex before writing the request. The write can block while the daemon enters catatonic mode and installs a replacement pipe. If the old pipe's reader is then closed, the delayed write returns -EPIPE and the generic error path enters catatonic mode again. That transition acts on the current superblock state, closes the replacement pipe, and releases the new daemon generation's wait queues. Only enter catatonic mode when the pipe which failed is still the current pipe. Factor the already-locked transition so the identity check and state change are atomic with respect to another replacement. This was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest. An unprivileged UID 65534 lookup filled the old packet pipe before a normal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe received HUP and both a pending victim lookup and a later lookup failed with ENOENT in two out of two fresh-mount runs. With this change, the new pipe remained active, received an intact 304-byte request, and both victim lookups completed in two out of two runs. Normal lookup and restart-without-a-blocked-writer controls passed. No KASAN, oops, refcount, or lock diagnostic was observed. A source reproducer and complete local logs are available privately on request. The demonstrated impact is limited to denial of a shared autofs service during a legitimate daemon restart. No memory corruption, information leak, privilege escalation, or code execution primitive was observed.

References

Community reviews

Loading reviews…