CVE-2026-99180

A flaw was found in the Linux kernel's Unicode subsystem. This issue occurs because character mapping tables used for case-insensitive file lookups are freed immediately upon unmounting a filesystem without waiting for active path lookups to complete. A local user could exploit this race condition to trigger a use-after-free vulnerability, resulting in a Denial of Service (DoS) via a system crash or potential memory corruption.

This vulnerability is rated as Moderate because exploitation is restricted to local attackers, requires non-default filesystem configurations, and depends on winning a narrow timing window to achieve a denial of service. In typical Red Hat Enterprise Linux environments, Unicode casefolding is not enabled by default on supported filesystems such as ext4 or tmpfs. Triggering the flaw requires a local user to race an in-flight directory path lookup against the asynchronous release of the final reference to an unmounted casefolded volume.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.