CVE-2026-99084: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-99084 is a denial-of-service vulnerability in the Linux kernel's readdir implementation caused by improper inode locking on immutable directories. The iterate_dir() function unnecessarily holds the directory's i_rwsem shared lock across ->iterate_shared() calls, even for directories (such as nullfs mount namespace roots) that never change and are never removed. This allows a local attacker to stall all other users sharing the same inode by holding the lock indefinitely during a getdents() operation. The vulnerability affects Linux kernel version 7.1 (introduced at commit 9d4e752a24f740b31ca827bfab07010e4e7f34b0), with fixes available in kernel 7.2.12+ and 7.3+. The CVSS category is estimated as Medium (GitHub Advisory, Feedly).

The root cause is an unnecessary exclusive/shared lock (i_rwsem) held by iterate_dir() during directory iteration for directories that are immutable — specifically nullfs directories used as roots of empty mount namespaces and kernel thread private namespaces. Because a single nullfs inode is shared across unrelated users, a malicious local user can back a getdents() buffer with a mapping of a file on a FUSE mount they control, cause a page fault on the copy of . and .., and instruct the FUSE server to delay its response indefinitely — holding the shared lock for an arbitrary duration. Any exclusive lock waiter (e.g., mkdir() via start_dirop()) queued behind this reader will then block all subsequent lookups, creates, and mounts in that directory. The fix introduces a new FOP_IMMUTABLE flag for file operations of directories that never change and are never removed, causing iterate_dir() to skip the lock entirely for such directories; ->f_pos is already protected by f_pos_lock since directories use FMODE_ATOMIC_POS (GitHub Advisory).

Successful exploitation results in a local denial-of-service condition affecting all users sharing the same nullfs mount namespace root inode. A single malicious local user can stall every other user in empty mount namespaces, blocking directory lookups that miss the dcache, file/directory creation, and mount operations until the attacker releases the lock. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (October 23, 2026). Exploitation requires local access with the ability to create mount namespaces and FUSE mounts, limiting the attack surface to privileged or specially capable local users. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score or threat actor attribution is currently available (Feedly, GitHub Advisory).

1. Prerequisite: Obtain a local account on a Linux 7.1 system with the ability to create user/mount namespaces and FUSE mounts (e.g., via CAP_SYS_ADMIN or unprivileged user namespace support).
2. Set up a FUSE mount: Create a FUSE filesystem under your control where the FUSE server can be made to delay or block responses indefinitely.
3. Map a FUSE-backed file: Create a memory mapping of a file residing on your FUSE mount.
4. Trigger getdents() on the nullfs directory: Call getdents() (or getdents64()) on the nullfs directory (the root of an empty mount namespace), providing the FUSE-backed memory mapping as the output buffer.
5. Induce a page fault: When the kernel attempts to copy . and .. entries into the buffer, a page fault occurs because the backing page is on the FUSE mount. The kernel waits for the FUSE server to service the fault.
6. Stall the FUSE server: Instruct your FUSE server not to respond, causing the getdents() call — and the held i_rwsem shared lock — to remain active indefinitely.
7. Observe denial of service: Any other user or process attempting a mkdir(), lookup, create, or mount in the same nullfs directory will block waiting for the exclusive lock, effectively stalling all users of empty mount namespaces on the system (GitHub Advisory, Feedly).

• Process Behavior: Processes stuck in uninterruptible sleep (D state in ps output) waiting on i_rwsem for the nullfs directory inode; visible via cat /proc/<pid>/wchan showing rwsem_down_read or similar lock wait.
• Logs: Kernel logs (dmesg) may show hung task warnings (if CONFIG_DETECT_HUNG_TASK is enabled) for processes blocked on directory operations in the nullfs mount namespace root.
• System Calls: Unusual long-running getdents() or getdents64() syscalls on nullfs directory file descriptors, detectable via strace or auditd syscall auditing.
• FUSE Activity: Unexpected FUSE mount activity from a non-privileged user combined with concurrent stalling of mount namespace operations (Feedly).

Apply the available Linux kernel patches: commit 6d30b399ae28e5166d62484f81ccaefde6fe7996 (for the 7.2.x stable branch, fixed in 7.2.12) and commit e08f57a7dcb83818c058e415988c23beb6c5a47f (for the 7.3+ branch). As a workaround where immediate patching is not possible, restrict unprivileged user namespace creation (sysctl -w kernel.unprivileged_userns_clone=0) and limit FUSE mount capabilities to trusted users to reduce the attack surface. Monitor for unusual getdents() operations holding locks for extended periods (GitHub Advisory, Feedly).