Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99180— unicode: free the map after a grace period

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： unicode：在宽限期（grace period）过后释放映射表 和 函数会读取 并解引用 unicode 映射表，而此时处于 RCU 模式的路径遍历（pathwalk）仅持有 。使用这些函数的文件系统（ext4、f2fs 和 tmpfs）会在 中通过 释放映射表，而该函数仅在挂载点的最后一个引用消失时执行。若此时仍有查找操作正在该文件系统内部进行，则可能读取到已被释放的映射表，从而引发问题。 当路径遍历被阻塞在 中，而 casefold 模式的 tmpfs 的最后一

CVSS 7.8 · High EPSS 0.13% · P3

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux b886ee3e778ec2ad43e276fd378ab492cf6819b7< 092e14e1479a39157ca01668d43e4649793f39ed affected
b886ee3e778ec2ad43e276fd378ab492cf6819b7< 6472455f2b015cad43adb790cb63fe1d3cff2f57 affected
b886ee3e778ec2ad43e276fd378ab492cf6819b7< f96c2731a105d6663c606388f5dc21781e00ade5 affected
b886ee3e778ec2ad43e276fd378ab492cf6819b7< 5d7687b0b71601cc32f1bfd62f56cf5eea3e5a07 affected
b886ee3e778ec2ad43e276fd378ab492cf6819b7< 69a0d6b31d05e856c7335509222f25321e3c69ca affected
b886ee3e778ec2ad43e276fd378ab492cf6819b7< 2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8 affected
b886ee3e778ec2ad43e276fd378ab492cf6819b7< 6560c3d9a6925e3747d9ad8463e16010c31ba715 affected
b886ee3e778ec2ad43e276fd378ab492cf6819b7< a96c5299bd7305eb984377681eb3222a57376405 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99180

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
unicode: free the map after a grace period
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period generic_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcu_read_lock(). The filesystems that use them, ext4, f2fs and tmpfs, drop the map with utf8_unload() from ->put_super(), which runs when the last reference to the mount goes away. A lookup that is still inside such a filesystem at that point reads a freed map. With a pathwalk held up in utf8_casefold_hash() while the last reference to a casefolded tmpfs goes away: BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950 Read of size 8 at addr ff110001030fe658 by task walker/98 Call Trace: <TASK> utf8nlookup+0x74c/0x950 utf8byte+0x160/0x1560 utf8_casefold_hash+0x167/0x230 generic_ci_d_hash+0xdd/0x1c0 link_path_walk+0x11ad/0x1d30 path_lookupat+0x63/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 [...] Allocated by task 94: __kmalloc_cache_noprof+0x249/0x560 utf8_load+0x4e/0x570 shmem_parse_opt_casefold.isra.0+0x92/0x270 [...] Freed by task 97: kfree+0x1db/0x5b0 shmem_put_super+0x72/0x170 generic_shutdown_super+0x14c/0x530 kill_anon_super+0x3a/0x60 deactivate_locked_super+0x9c/0xf0 cleanup_mnt+0x9f/0x130 So far that has been hard to hit. umount(2) waits for a grace period in namespace_unlock() before it drops the mount, so only a mount whose last reference goes away elsewhere, like the close of a file or a chdir out of a lazily unmounted directory, can race a walker. So it is reachable. Delay the free until a grace period has passed. The map and the data table it holds a reference to then outlive any pathwalk that found the superblock before the mount went away. The reference on the data table module is dropped from the rcu callback as well. utf8-core is built in whenever CONFIG_UNICODE is set, so there is no module exit that would have to wait for the callbacks. Overlayfs points the s_encoding of an overlay at the map of its first layer without taking a reference of its own. That stays correct. The layer is held by the overlay, so its map is dropped only after the overlay is gone.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b886ee3e778ec2ad43e276fd378ab492cf6819b7 ~ 092e14e1479a39157ca01668d43e4649793f39ed -
Linux Linux 5.2 -

II. Public POCs for CVE-2026-99180

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99180

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99180 (5)

Same Patch Batch · Linux · 2026-10-28 · 117 CVEs total

CVE-2026-99153 9.8 CRITICAL scsi: libiscsi: Validate the ITT reflected in a Reject PDU
CVE-2026-99154 9.8 CRITICAL scsi: libiscsi: Reject a negative task index from parse_pdu_itt
CVE-2026-99170 8.8 HIGH namespace: a mount that copy_tree() leaves out can't take over a lock
CVE-2026-99185 8.8 HIGH firewire: core: fix race condition in split transaction handling
CVE-2026-99216 8.4 HIGH Drivers: hv: Don't reset VMBus connection state on error/exit paths
CVE-2026-99131 8.2 HIGH xfs: fix capability check in xfs
CVE-2026-99117 7.8 HIGH net: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99116 7.8 HIGH net: psp: do not inherit the Rx association on clone
CVE-2026-99163 7.8 HIGH tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields
CVE-2026-99143 7.8 HIGH tracing: Keep the predicate limit separate from program capacity
CVE-2026-99164 7.8 HIGH spi: imx: fix slab corruption from undersized DMA bounce buffers
CVE-2026-99109 7.8 HIGH smb: client: reject SetEA requests that do not fit the request buffer
CVE-2026-99167 7.8 HIGH net/sched: fix use-after-free in __tcf_action_put()
CVE-2026-99173 7.8 HIGH eventfs: Free the eventfs_inode after an rcu grace period too
CVE-2026-99177 7.8 HIGH KVM: SEV: Fix page dirtying in sev_gmem_post_populate()
CVE-2026-99203 7.8 HIGH pipe: preserve existing fasync readers on writer setup failure
CVE-2026-99213 7.8 HIGH vsock: treat TCP_CLOSING as once-established
CVE-2026-99156 7.8 HIGH scsi: st: Fix use-after-free race between st_remove() and st_open()
CVE-2026-99107 7.8 HIGH ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize
CVE-2026-99152 7.5 HIGH scsi: libiscsi: Validate the task named by a management response

Showing top 20 of 117 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux