autofs: fix sbi->pipe file reference leak in autofs_kill_sb()

Summary

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi->pipe file reference leak in autofs_kill_sb() When autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for example, when find_get_pid() fails on an invalid pgrp mount option, or when an fs_context is closed before mounting), deactivate_locked_super() invokes autofs_kill_sb() -> autofs_catatonic_mode(sbi). Because AUTOFS_SBI_CATATONIC is still set in sbi->flags, autofs_catatonic_mode() returns early without calling fput(sbi->pipe), permanently leaking the pipe struct file reference. Explicitly release sbi->pipe in autofs_kill_sb() if it is still non-NULL after autofs_catatonic_mode().

Timeline

1. Oct 18, 2026, 3:18 PM UTCCVE published
2. Oct 19, 2026, 9:21 AM UTCRecord last updated

Affected versions

• Linux Linux

  From ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7 · fixed in 3684e2273ba94553af3c5195a46a50214a1a96e3; From ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7 · fixed in 0662b1ff9b383d5a233d344e4dc518c27a17f7b8; From ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7 · fixed in 34fa4c1c6e10507dc60e35a82cc9655666946cfd; From ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7 · fixed in a58593b501b7be5ad2bc5181bfa8cd4599be257c; From ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7 · fixed in f1c57f5b16bbc3571bd479c290996c4d4e1fb931; From ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7 · fixed in 4bcb371019097d0e357f097902587401c509bbc9; From ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7 · fixed in fc4fd0281ac80b5a3c5a2330f688f0f9d2a420b6; From ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7 · fixed in aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e

• Linux Linux

  4.18

• KernelLinux

  From 4.18.0 · fixed in 5.10.271; From 5.11.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.55; From 6.19.0 · fixed in 7.2.9

References 8