Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-98987— namespace: look at the topmost mount for a mount namespace file

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已被修复：命名空间：检查挂载命名空间文件的最顶层挂载函数会预先为源挂载的最顶层挂载的根目录分配一个挂载点，以便将原本位于目标位置的挂载叠加到源挂载之上，或者叠加到其传播副本之上。在创建这些副本时，并未设置标志，因此副本的覆盖挂载（overmounts）链比源挂载的链更短。该链在第一个挂载命名空间文件的绑定挂载处终止。因此，当循环向上遍历源挂载链时，它会记住该挂载的挂载点（保存在变量中），并将现有挂载放置到该位置以用于副本。然而，该循环在到达最顶层挂载时便终止，却从未检查该

AI Predicted 7.8 Difficulty: Moderate EPSS 0.17% · P6 Updated Oct 23, 2026

Possible ATT&CK Techniques 2 AI

T1069.001 · Local Groups T1083 · File and Directory Discovery

Affected Version Matrix 8

Vendor	Product	Version Range	Status
Linux	Linux	`96f5d2e051653f2cfe9137c5d3c7794c358ffb03< b9c40553f6ceba50042281eef6f701e5fb719726`	affected
		`96f5d2e051653f2cfe9137c5d3c7794c358ffb03< 87ecd4c6da146363384a603bd9e90c90e7275536`	affected
		`96f5d2e051653f2cfe9137c5d3c7794c358ffb03< 8714b44adac7b10506e1db3ef1710689751f0f10`	affected
		`6.17`	affected
		`< 6.17`	unaffected
		`6.18.57≤ 6.18.*`	unaffected
		`7.2.11≤ 7.2.*`	unaffected
		`7.3≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

namespace: look at the topmost mount for a mount namespace file

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attach_recursive_mnt() preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on top of the source or on top of one of its propagated copies. The copies are made without CL_COPY_MNT_NS_FILE so their chain of overmounts is shorter than the source's. It ends below the first bind mount of a mount namespace file. So while the loop walks up the chain of the source it remembers the mountpoint of that mount in "shorter" and the existing mount is put there for the copies. But the loop ends at the topmost mount without ever looking at it. If the topmost mount is the only mount namespace file in the chain "shorter" stays NULL and mnt_change_mountpoint() attaches the existing mount of the copy below the root of the mount namespace file. That's a dentry of nsfs. No path walk in the copy's mount namespace ever gets there. The mount is gone until its parent goes and the copy that took its place can't be unmounted synchronously because it has a child: S bind mount of a file N bind mount of a mount namespace file on top of S A shared mount, B a slave of A, Q mounted on B/file move_mount(S, A/file) cat B/file -> the content of S instead of Q umount B/file -> EBUSY Look at every mount of the chain including the topmost one.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	96f5d2e051653f2cfe9137c5d3c7794c358ffb03 ~ b9c40553f6ceba50042281eef6f701e5fb719726	-
Linux	Linux	6.17	-

II. Public POCs for CVE-2026-98987

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-98987

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98987 (2)

https://www.cve.org/CVERecord?id=CVE-2026-98987

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959	9.8 CRITICAL	btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988	8.8 HIGH	namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083	8.8 HIGH	ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082	8.8 HIGH	KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98870	8.8 HIGH	ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980	8.8 HIGH	namei: don't reveal overmounted entries in refwalk
CVE-2026-98981	8.8 HIGH	namespace: unhash a dentry before detaching the mounts on it
CVE-2026-99042	8.4 HIGH	io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98978	8.4 HIGH	namespace: never expire a locked mount
CVE-2026-99064	8.1 HIGH	cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968	8.1 HIGH	amt: send the relay's General Query directly from the receive path
CVE-2026-98944	7.8 HIGH	HID: steam: Refactor registration
CVE-2026-99053	7.8 HIGH	tipc: hold a reference to nodes found by link name
CVE-2026-99054	7.8 HIGH	tipc: destroy topsrv workqueues before closing connections
CVE-2026-99056	7.8 HIGH	strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-99002	7.8 HIGH	drm/vmwgfx: validate pitch coming from userspace
CVE-2026-98899	7.8 HIGH	netfilter: ipset: mark the rcu locked areas properly
CVE-2026-99006	7.8 HIGH	drm/i915/gem: Prevent overstepping exec array boundary

Showing top 20 of 217 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux