In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: cancle set bad inode after removing name fails The reproducer uses a file0 on a ntfs3 file system with a corrupted ilink. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted. The underlying bug is that makebadinode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, dsplicealias() is called to attach it to dentry, while another thread decides to call makebadinode() on it - that would evict it from icache, but we'd already found it there earlier". In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call makebad_inode() on it just for shits and giggles".