A vulnerability in the Linux kernel overlay filesystem allows a local, authenticated attacker to trigger a double release of resources, potentially leading to system instability or unauthorized access.

This is a resource management flaw in the overlayfs (ovl) driver where an error handling path in ovl_create_real() performs a double call to end_creating(). This results in the premature unlocking of the parent directory's inode lock and an incorrect dentry reference count, which requires an authenticated local user to trigger.

The vulnerability carries a CVSS score of 7.8, reflecting its high impact on system integrity, confidentiality, and availability. While the attack vector requires local access, successful exploitation could lead to kernel-level denial of service, rendering systems unresponsive, or potentially provide a path for privilege escalation, which poses a significant risk to organizational infrastructure.

Immediate Action: Administrators should update the Linux kernel to version 6.18.51, 7.2.4, or later immediately to incorporate the necessary fix.

Proactive Monitoring: Monitor system logs for repeated "pr_warn_ratelimited" warnings related to overlayfs consistency checks, as these may indicate attempts to trigger the error path.

Compensating Controls: Restrict local shell access to untrusted users and enforce strict permissions on mount points to limit the ability of unauthorized processes to interact with the overlay filesystem.

Public Exploit Available: No

This vulnerability represents a significant stability and security risk for systems utilizing overlay filesystems. Given the potential for kernel-level impact, IT teams should prioritize patching the Linux kernel to the provided safe versions during the next maintenance window. Failure to address this could result in system-wide service disruption or security compromises originating from local user accounts.