--- a/fs/ceph/dir.c	2026-09-07 21:58:11.185785145 -0700
+++ b/fs/ceph/dir.c	2026-09-07 21:58:11.211963004 -0700
@@ -918,7 +918,13 @@
 		d_drop(result);
 		return -ESTALE;
 	}
-	return PTR_ERR(result);
+	/*
+	 * ceph_lookup() returns NULL after d_add()ing a negative dentry, and
+	 * PTR_ERR(NULL) is 0.  Reporting success here leaves the caller with
+	 * a negative dentry, which filename_mknodat() then hands to
+	 * security_path_post_mknod() -> d_backing_inode() == NULL.
+	 */
+	return result ? PTR_ERR(result) : -ESTALE;
 }
 
 static int ceph_mknod(struct mnt_idmap *idmap, struct inode *dir,