CVE-2026-98539

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga

ntfs_create_inode() creates a new inode via ntfs_new_inode(). It hashes

it with insert_inode_locked() and so it's marked as I_NEW until

unlock_new_inode().

ntfs 3 calls d_instantiate() in between though... Since the dentry was

already hashed by the lookup before the create any path walk finds it

without touching the parent's i_rwsem and so can lock the inode.

If the inode is a directory unlock_new_inode() calls

lockdep_annotate_inode_mutex_key() and marks i_rwsem with the

i_mutex_dir_key class.

That resets the count and the owner of a lock somebody else may already

hold by now...

syzbot has been spamming us with the same godforsaken bug

"WARNING in do_new_mount"

since 2023. I can't take it anymore so I went looking. Afaict, syzbot's

executor chdirs into a freshly mounted ntfs3 image, creates a

directory

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References