Fix "umount: target is busy" and "Device or resource busy"

cd ~
sudo fuser -vm /mnt/usb
sudo lsof +f -- /mnt/usb
sudo umount /mnt/usb

The exact text depends on the tool:

umount: /mnt/usb: target is busy.
umount: /media/user/DISK: target is busy.
        (In some cases useful info about processes that use
         the device is found by lsof(8) or fuser(1).)
Error unmounting /dev/sdb1: target is busy
mkfs.ext4: /dev/sdb1 is apparently in use by the system; will not make a filesystem here!
wipefs: error: /dev/sdb: probing initialization failed: Device or resource busy

What the error means

The kernel returns EBUSY because something still references the filesystem or block device. For a mount point, that is a process with an open file, a current working directory or a memory-mapped file inside it, or another filesystem mounted underneath it. For a raw device, it is a mount, swap, a device-mapper mapping (LUKS, LVM) or a RAID member. The kernel will not drop these references for you, because doing so could lose data.

Cause 1: a process has files open on the mount

By far the most common cause: a file manager window, an open document, a terminal sitting in the directory, a media player, or an indexer such as GNOME's LocalSearch (formerly Tracker) or KDE's Baloo. List the processes:

sudo fuser -vm /mnt/usb

Example output:

                     USER        PID ACCESS COMMAND
/mnt/usb:            root     kernel mount /mnt/usb
                     alex       4182 ..c.. bash
                     alex       5120 F.... vlc

The access letters tell you why: c = current directory, F = open file, m = mapped file, e = running executable. lsof gives the file names too:

sudo lsof +f -- /mnt/usb

Close the application, cd out of the directory in every terminal, then unmount. If a process will not exit, stop it politely first and forcefully only if needed:

kill 5120
# still running after a few seconds:
kill -9 5120
# or kill everything using the mount (asks for each process with -i):
sudo fuser -kim /mnt/usb

Cause 2: a system service is using it

Services such as Docker, Samba, an NFS server, a database or a backup timer may have the mount open. fuser shows the PID; map it to a unit and stop that unit:

ps -o unit= -p 5120
sudo systemctl stop smbd.service

The systemctl cheat sheet lists the related commands. If a .mount or .automount unit manages the path (common for fstab entries with x-systemd.automount), stop it with sudo systemctl stop mnt-usb.mount so systemd does not immediately remount it.

Cause 3: something is mounted inside it, or it is swap / LUKS / LVM

A nested mount keeps the parent busy, and an active swap file or partition cannot be unmounted at all. Look at the tree:

findmnt -R /mnt/data
lsblk -o NAME,TYPE,FSTYPE,MOUNTPOINTS /dev/sdb
swapon --show

Release from the inside out:

sudo umount /mnt/data/sub     # nested mounts first (or: sudo umount -R /mnt/data)
sudo swapoff /mnt/data/swapfile
sudo vgchange -an myvg        # LVM volume group on that disk
sudo cryptsetup close luks-1234   # LUKS mapping, after unmounting what is on it
sudo mdadm --stop /dev/md0    # software RAID

This is also the fix for "Device or resource busy" from mkfs, wipefs, parted or dd. Before partitioning, double-check the device name with lsblk: writing to the wrong disk is unrecoverable. The disk management guide covers partitioning and formatting step by step.

Cause 4: a hung network share (NFS, SMB, sshfs)

When the server goes away, processes block in uninterruptible I/O and the share cannot be unmounted normally. Force or lazily unmount it:

sudo umount -f /mnt/nfs      # NFS: abort pending requests
sudo umount -l /mnt/nfs      # lazy: detach now, clean up when unused
fusermount3 -u ~/remote      # sshfs / other FUSE mounts as your user

Lazy unmount is acceptable here because there is no local data at risk. For local disks, prefer finding the process.

Cause 5: you are trying to unmount / or /home

You cannot unmount the root filesystem of a running system, and /home is held by your own session. To work on them (resize, fsck, reformat), boot a live USB, or log out of the desktop, switch to a text console with Ctrl+Alt+F3, log in as root and unmount from there.

Distro-specific notes

• GNOME (Ubuntu, Fedora, Debian): the file manager's eject button gives "target is busy" if LocalSearch is indexing; wait for it to finish, or turn off indexing for that location in Settings, Search.
• KDE Plasma: Baloo can hold removable drives; balooctl6 suspend pauses it.
• Snap apps (Ubuntu): a snap with the removable-media interface can hold /media paths; close the app.
• All distros: udisksctl unmount -b /dev/sdb1 and then udisksctl power-off -b /dev/sdb is the command-line equivalent of "Safely remove".

How to prevent it

• Close files and cd out before unmounting; make cd ~ && sudo umount a habit in scripts.
• For network shares in fstab, use _netdev,x-systemd.automount with a timeout so a missing server does not hang the system.
• Exclude removable drives from desktop search indexing if you plug them in and out often.
• Never pull a drive that refuses to unmount. Forcing it out mid-write is a common way to end up with a read-only file system on the next mount.
• Give optional disks in fstab the nofail option, so a missing drive does not drop the next boot into emergency mode.

Frequently asked questions