{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98978", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.383Z", "datePublished": "2026-10-23T12:19:51.428Z", "dateUpdated": "2026-10-24T14:09:47.444Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:47.444Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: never expire a locked mount\n\nLocked mounts are special. They protect the underlying files and\ndirectories from being revealed. do_umount() refuses to unmount locked\nmounts but shrink_submounts() doesn't.\n\nA shrinkable mount can become locked once the owner of a user namespace\nputs it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked\nproperty now moves to the mount at the bottom making it possible to\nunmount the top mount.\n\nSo umount() of an unlocked ancestor now expires the bottom mount first\nand the covered directory is revealed:\n\n move_mount(c -> x/hidden, MOVE_MOUNT_BENEATH) = 0\n the cover after the lock moved: umount2(x/hidden) = 0\n the holder of the lock: umount2(x/hidden) = EINVAL\n the root of the copy, busy: umount2(x) = EBUSY\n reads x/hidden/secret: \"covered-by-root\"\n\nSo leave a locked mount alone as it dies together with its parent. A\nplain umount() of an unlocked mount with a locked one below it is EBUSY\nfrom now on. It's the same for any other locked child. A lazy umount\nstill takes the whole tree.\n\nmark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree()\nleaves a mount on an expiry list alone and nothing else puts a locked\none on such a list. Add an assert for this." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 8.4, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - umount2() reaches ksys_umount() -> path_umount() -> do_umount() -> shrink_submounts() -> the patched shrink_submount(); all triggering state is supplied through local mount syscalls, not a network protocol.\nAC:L - fuse_dentry_automount() can create an attacker-controlled mount that finish_automount() marks MNT_SHRINKABLE, and clone_mnt() preserves that flag. The lock transfer with MOVE_MOUNT_BENEATH and ancestor umount2() are deterministic and require no race.\nPR:L - move_mount() and can_umount() require may_mount(), which checks CAP_SYS_ADMIN in the mount namespace's owning user namespace. An ordinary user obtains that capability through unshare(CLONE_NEWUSER|CLONE_NEWNS), as exercised by expiry_child().\nUI:N - The attacker independently performs unshare(), bind mounts, move_mount(MOVE_MOUNT_BENEATH), umount2(), and the final file access; no victim action is needed after the sandbox mount layout exists.\nS:C - MNT_LOCKED is applied by lock_mnt_tree() specifically to stop a less-privileged child user/mount namespace from exposing resources hidden by its parent; removing that cover crosses this sandbox boundary.\nC:H - Vulnerable shrink_submount() calls umount_tree() on the locked mount, causing path lookup to fall through to the entire concealed directory subtree rather than a bounded datum; in a same-identity sandbox this can disclose all files protected solely by the mount cover.\nI:H - The same umount_tree() operation exposes every object below the covered directory; where the mount namespace was the access-control boundary for a same-identity sandbox, the attacker can modify or delete the entire otherwise-hidden writable subtree.\nA:N - The flaw neither corrupts memory nor crashes or hangs the kernel; umount_tree() detaches a mount from the attacker's copied mount namespace, and the demonstrated consequence is exposure of the covered path." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/namespace.c" ], "versions": [ { "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942", "lessThan": "6b8dc3713a76346d212abab46cbfc8d7070f534c", "status": "affected", "versionType": "git" }, { "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942", "lessThan": "d23265a12e4991ce7aedce670c0b6b598cadb644", "status": "affected", "versionType": "git" }, { "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942", "lessThan": "f78ddcc872248c7aa1d7e904928441a0be4c6d5d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/namespace.c" ], "versions": [ { "version": "3.12", "status": "affected" }, { "version": "0", "lessThan": "3.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "6.18.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "7.2.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.12", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/6b8dc3713a76346d212abab46cbfc8d7070f534c" }, { "url": "https://git.kernel.org/stable/c/d23265a12e4991ce7aedce670c0b6b598cadb644" }, { "url": "https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d" } ], "title": "namespace: never expire a locked mount", "x_generator": { "engine": "bippy-1.2.0" } } } }