In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_do_mkdir() debug print ovl_do_mkdir() prints the input… (CVE-2026-98921)

The vulnerability in the Linux kernel overlay filesystem (ovl) involves a use-after-free condition in the ovl_do_mkdir() function's debug printing. Specifically, after the vfs_mkdir() call, which may free or replace the input dentry, ovl_do_mkdir() prints the dentry using %pd, potentially accessing freed memory when CONFIG_OVERLAY_FS_DEBUG is enabled. This issue was introduced after commit fe497f0759e0, which changed vfs_mkdir() to unlock on failure and call end_creating() on the input dentry. The patch corrects this by printing the dentry before the vfs_mkdir() call and only printing the result afterward, preventing use-after-free.

The vulnerability can cause a use-after-free condition in kernel debug code related to overlay filesystem directory creation. This may lead to kernel instability or crashes when overlay filesystem debugging is enabled. There is no indication of active exploitation or broader impact beyond debug scenarios.

A fix has been implemented to prevent the use-after-free by adjusting the debug print order in ovl_do_mkdir(). Users should apply the official kernel patch that corrects this behavior. Since this affects debug code enabled by CONFIG_OVERLAY_FS_DEBUG, disabling this debug option can mitigate exposure until the patch is applied.