In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's… (CVE-2026-98539)

The vulnerability in the Linux kernel NTFS3 driver arises from the use of d_instantiate() in ntfs_create_inode() after the inode is hashed but before unlock_new_inode() is called. This causes the dentry to be found without locking the parent's i_rwsem, allowing concurrent operations to corrupt the inode's read-write semaphore lock state. Specifically, if the inode is a directory, unlock_new_inode() resets the lock count and owner, potentially causing underflow and deadlocks when inode_lock() is called concurrently. The issue was triggered by syzbot's test case involving concurrent mkdir and mount operations on NTFS3. The resolution involves switching to d_instantiate_new() and dropping the trailing unlock_new_inode(), ensuring error paths correctly discard the new inode without corrupting lock state.

This vulnerability can cause kernel warnings related to lock state corruption and may lead to deadlocks or hangs during filesystem operations involving NTFS3 mounts and directory creation. It affects system stability and reliability but does not indicate direct privilege escalation or data corruption from the provided information.

A fix has been implemented in the Linux kernel to address this issue by using d_instantiate_new() instead of d_instantiate() in ntfs_create_inode() and removing the trailing unlock_new_inode() call. Users should update to the fixed kernel version once available. No additional mitigation is required as the patch resolves the underlying locking issue.