Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98979— namespace: refuse an automount below a mount that is in no namespace

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： 命名空间：拒绝在“不属于任何命名空间”的挂载点下方进行自动挂载 即使父挂载点不在调用者的挂载命名空间中，系统仍可能允许添加自动挂载。唯一的限制条件是：父挂载命名空间不能为 NULL（即未被卸载）。 问题在于 使用了 标志，这使得上述检查条件轻易成立。因此，检查通过， 将该挂载点接受为自动挂载点。更奇怪的是， 随后会解引用 ，而该标志实际上是一个错误指针（error pointer）。 攻击者可以通过 在用户空间触发此问题。例如，当对 overlay 文件系统的底层文件系

AI Predicted 9.8 Difficulty: Moderate EPSS 0.21% · P10

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux df820f8de4e481222b17f9bcee7b909ae8167529< 95fb7c259b86f5521f04973040ad492f2bef6f82 affected
df820f8de4e481222b17f9bcee7b909ae8167529< 35f2013f83ef16f9f0331c4c3a8e8d161580d574 affected
df820f8de4e481222b17f9bcee7b909ae8167529< 494c57572d2d5bc2839553ed41aabe92ed0f587c affected
df820f8de4e481222b17f9bcee7b909ae8167529< 776e20e4fdc23c23687b511ffdc80047878049d3 affected
df820f8de4e481222b17f9bcee7b909ae8167529< ba985ce08471c555af2a2fbe217c1bc2e72a6d8c affected
5.8 affected
< 5.8 unaffected
6.6.160≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98979

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
namespace: refuse an automount below a mount that is in no namespace
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount namespace must not be NULL, i.e., unmounted. Problem is that clone_private_mount() has MNT_NS_INTERNAL which makes that trivially true. So that passes the test and attach_recursive_mnt() accepts that as a mount point and funny enough, count_mounts() dereferences MNT_NS_INTERNAL. The problem is it is an error pointer... So we can reach this in userspace via fanotify. A filesystem mark on the lower filesystem of an overlay reports paths on the layer clone and reading the event hands out a descriptor on it. For example with debugfs as the lower layer it goes kaboom: openat(evfd, "tracing", O_DIRECTORY) Oops: general protection fault KASAN: null-ptr-deref in range [0x1d0-0x1d7] RIP: 0010:count_mounts+0x35/0x200 attach_recursive_mnt finish_automount And since that sleeping beauty happens under namespace_sem held for writing every mount operation on the system blocks from then on. Congrats. Use is_mounted() instead which rejects unmounted and internal mounts alike. The open fails with EINVAL just as it did before clone_private_mount() used MNT_NS_INTERNAL.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux df820f8de4e481222b17f9bcee7b909ae8167529 ~ 95fb7c259b86f5521f04973040ad492f2bef6f82 -
Linux Linux 5.8 -

II. Public POCs for CVE-2026-98979

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98979

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98979 (5)

Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-99053 7.8 HIGH tipc: hold a reference to nodes found by link name
CVE-2026-99051 7.8 HIGH fsverity: RCU-delay the freeing of struct fsverity_info
CVE-2026-98975 7.8 HIGH xfs: stop exchanging reflink flags when exchanging mappings
CVE-2026-98974 7.8 HIGH xfs: fix exchange-range-to-eof file size exchange
CVE-2026-98999 7.8 HIGH drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
CVE-2026-99050 7.8 HIGH gpio: mpsse: fix race when arming the IRQ poll worker
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections

Showing top 20 of 218 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98979

No comments yet

Leave a comment