Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98985— namespace: check the mounts before reading their parents in pivot_root()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： 命名空间：在 pivot_root() 中读取父挂载点之前，先检查挂载点本身 函数在检查 和调用者根挂载点是否属于共享挂载点之前，会先读取它们的父挂载点，而并未先验证这些挂载点是否位于调用者的挂载命名空间中。此时仅持有 锁。对于位于调用者挂载命名空间内的挂载点，这种操作是安全的。 然而， 可能是一个指向已被卸载、仅由文件描述符维持存活的挂载点的文件描述符。如果该挂载点在卸载时仍与其父挂载点保持关联，则没有任何引用会“固定”（pin）其父挂载点。当父挂载点的最后一次 执行

AI Predicted 7.8 Difficulty: Hard EPSS 0.17% · P6

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux e0c9c0afd2fc958ffa34b697972721d81df8a56f< a56d4f8f8f4c5d9ac339d5c03a9d90eecd3697fc affected
e0c9c0afd2fc958ffa34b697972721d81df8a56f< 3c2441e21c3df867e4131e0ff784ecdb3a7a55f8 affected
e0c9c0afd2fc958ffa34b697972721d81df8a56f< e3aba6900483f64e6c9eb328150dd633b7d36c1c affected
e0c9c0afd2fc958ffa34b697972721d81df8a56f< 3dad2330c89343ba083cf7868779083fd5fbe0fe affected
e0c9c0afd2fc958ffa34b697972721d81df8a56f< 6b7c001eb5857fa09041f47673666060a2e5fc1c affected
84b78514033ff22c443473214ab6d0508394cf7a affected
4.0.2< 4.1 affected
4.1 affected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98985

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
namespace: check the mounts before reading their parents in pivot_root()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot_root() path_pivot_root() reads the parents of new_root and of the caller's root and checks whether they are shared before it checks that either mount is in the caller's mount namespace. Only namespace_sem is held. That's fine for a mount that is in the caller's mount namespace. But new_root can be a file descriptor to a mount that has been unmounted and that only the file descriptor keeps alive. If that mount stayed attached to its parent when it was unmounted nothing pins the parent for it. The final mntput() of the parent unhooks the children under mount_lock alone and frees the parent afterwards: pivot_root() close(fd), last ref on the parent ------------ --------------------------------- ex_parent = new_mnt->mnt_parent mntput_no_expire_slowpath() __umount_mnt(new_mnt) cleanup_mnt() call_rcu() IS_MNT_SHARED(ex_parent) BUG: KASAN: slab-use-after-free in path_pivot_root+0xf1a/0x1840 Read of size 4 at addr ffff8881047382f8 by task pivot_widen/157 path_pivot_root+0xf1a/0x1840 __x64_sys_pivot_root+0x165/0x190 The same goes for the caller's root via chroot(). Both outcomes of the check end in EINVAL so nothing but the read itself goes wrong. It's the same thing commit bb4609405752 ("statmount: read the parent of an unmounted mount under mount_lock") fixed for statmount(). Check that both mounts are in the caller's namespace before their parents are read. Every path returns EINVAL either way.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux e0c9c0afd2fc958ffa34b697972721d81df8a56f ~ a56d4f8f8f4c5d9ac339d5c03a9d90eecd3697fc -
Linux Linux 4.1 -

II. Public POCs for CVE-2026-98985

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98985

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98985 (5)

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-98944 7.8 HIGH HID: steam: Refactor registration
CVE-2026-99053 7.8 HIGH tipc: hold a reference to nodes found by link name
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections
CVE-2026-99056 7.8 HIGH strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-99002 7.8 HIGH drm/vmwgfx: validate pitch coming from userspace
CVE-2026-98899 7.8 HIGH netfilter: ipset: mark the rcu locked areas properly
CVE-2026-99006 7.8 HIGH drm/i915/gem: Prevent overstepping exec array boundary

Showing top 20 of 217 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux