{"id":"AZL-108863","summary":"CVE-2026-98553 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nautofs: fix sbi-\u003epipe file reference leak in autofs_kill_sb()\n\nWhen autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for\nexample, when find_get_pid() fails on an invalid pgrp mount option, or\nwhen an fs_context is closed before mounting), deactivate_locked_super()\ninvokes autofs_kill_sb() -\u003e autofs_catatonic_mode(sbi).\n\nBecause AUTOFS_SBI_CATATONIC is still set in sbi-\u003eflags,\nautofs_catatonic_mode() returns early without calling fput(sbi-\u003epipe),\npermanently leaking the pipe struct file reference.\n\nExplicitly release sbi-\u003epipe in autofs_kill_sb() if it is still non-NULL\nafter autofs_catatonic_mode().","modified":"2026-10-20T05:35:13Z","published":"2026-10-18T16:17:07Z","upstream":["CVE-2026-98553"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98553"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108863.json"}}],"schema_version":"1.9.0"}