KCSAN: data-race in __lookup_mnt / umount_mnt

Status: moderation: reported C repro on 2026/10/13 05:57
Labels: prio:low race:benign
[Documentation on labels]
Reported-by: syzbot+ffe78e1008e7ae210843@syzkaller.appspotmail.com
First crash: 4h30m, last: 4h30m
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
51646202 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in __lookup_mnt / umount_mnt 2026/10/13 06:38 2026/10/13 06:38 2026/10/13 06:42 745a967f
4b716c7e assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in __lookup_mnt / umount_mnt 2026/10/13 06:17 2026/10/13 06:17 2026/10/13 07:13 745a967f

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __lookup_mnt / umount_mnt

write to 0xffff888104cc9518 of 8 bytes by task 3644 on cpu 1:
 __umount_mnt fs/namespace.c:1042 [inline]
 umount_mnt+0x65/0x2d0 fs/namespace.c:1056
 umount_tree+0x757/0x960 fs/namespace.c:1878
 do_umount fs/namespace.c:-1 [inline]
 path_umount+0x887/0x8f0 fs/namespace.c:2105
 ksys_umount fs/namespace.c:2128 [inline]
 __do_sys_umount fs/namespace.c:2133 [inline]
 __se_sys_umount fs/namespace.c:2131 [inline]
 __x64_sys_umount+0xb6/0xe0 fs/namespace.c:2131
 x64_sys_call+0x225e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:167
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888104cc9518 of 8 bytes by task 3640 on cpu 0:
 __lookup_mnt+0xa2/0x1a0 fs/namespace.c:835
 __follow_mount_rcu+0xbc/0x2a0 fs/namei.c:1708
 handle_mounts fs/namei.c:1740 [inline]
 step_into_slowpath+0x3ab/0x600 fs/namei.c:2131
 step_into fs/namei.c:2181 [inline]
 walk_component fs/namei.c:2317 [inline]
 link_path_walk+0x947/0xdd0 fs/namei.c:-1
 path_parentat fs/namei.c:2889 [inline]
 __filename_parentat+0x1ad/0x460 fs/namei.c:2913
 filename_parentat fs/namei.c:2931 [inline]
 filename_unlinkat+0x9a/0x410 fs/namei.c:5717
 __do_sys_unlink fs/namei.c:5783 [inline]
 __se_sys_unlink+0x2b/0xe0 fs/namei.c:5780
 __x64_sys_unlink+0x1f/0x30 fs/namei.c:5780
 x64_sys_call+0x18ee/0x2550 arch/x86/include/generated/asm/syscalls_64.h:88
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810779f780 -> 0xffff88811dcd8cc0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3640 Comm: syz-executor409 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/13 05:56 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 24a19b953e2a 57bbd979 .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in __lookup_mnt / umount_mnt
* Struck through repros no longer work on HEAD.