Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98992— namespace: don't copy an unmounted mount tree

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： 命名空间：禁止复制未卸载的挂载树 函数在检查某个挂载点是否已挂载之前，就允许了根目录为 或 文件的挂载。这一例外情况原本是为了支持 和 挂载而设计的：因为这些挂载不属于任何挂载命名空间，所以 和 都无法通过它们；如果不做特殊处理，就无法对 或 进行绑定挂载（bind-mount）。 然而，问题在于该例外情况也允许对已“惰性卸载”（lazy unmount）但仅由文件描述符保持存活的此类文件进行绑定挂载。具体场景如下： 当使用 或 标志调用 时，它不会在遇到已卸载的挂载点

AI Predicted 5.5 Difficulty: Moderate EPSS 0.17% · P6

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux e149ed2b805fefdccf7ccdfc19eca22fdd4514ac< 86a2d56b1960720bf1844441c0890621e9db2f25 affected
e149ed2b805fefdccf7ccdfc19eca22fdd4514ac< 7e037b1fd339d865737c8accd29abcf40130a5a0 affected
e149ed2b805fefdccf7ccdfc19eca22fdd4514ac< b47b40c4f058418f9707454543179df240796aad affected
e149ed2b805fefdccf7ccdfc19eca22fdd4514ac< 8d3527457e183cedee3003c2897314da49488311 affected
e149ed2b805fefdccf7ccdfc19eca22fdd4514ac< 8bacbf6be959973b28b691713a872c12eae69eec affected
3.19 affected
< 3.19 unaffected
6.6.160≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98992

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
namespace: don't copy an unmounted mount tree
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no mount namespace so neither check_mnt() nor is_mounted() would let them through and bind-mounting a nsfsfd or a pidfd wouldn't work. Problem is that exception also admits a bind mount of such a file when it was lazily unmounted and is only kept alive by a file descriptor: mount --bind /proc/self/ns/net /tmp/x exec 3< /tmp/x umount -l /tmp/x mount --rbind /proc/self/fd/3 /tmp/y With MS_REC or AT_RECURSIVE copy_tree() doesn't stop at the unmounted mount. It copies every mount that stayed attached to it as well. So if you have a bunch of overmounts over the nsfsfd or the pidfd the whole unmounted stack is copied. That's a bug. So refuse to walk an unmounted tree. Copying its root alone stays possible. So a bind mount of a namespace that is gone can still be recreated from a file descriptor on the old one. The file descriptor pins that mount and its root and __has_locked_children() only reads the direct children which don't leave the parent's list without namespace_sem. The internal mounts carry MNT_NS_INTERNAL instead of NULL and are still walked. Copying an unmounted tree recursively fails with EINVAL.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux e149ed2b805fefdccf7ccdfc19eca22fdd4514ac ~ 86a2d56b1960720bf1844441c0890621e9db2f25 -
Linux Linux 3.19 -

II. Public POCs for CVE-2026-98992

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98992

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98992 (5)

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-98944 7.8 HIGH HID: steam: Refactor registration
CVE-2026-99053 7.8 HIGH tipc: hold a reference to nodes found by link name
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections
CVE-2026-99056 7.8 HIGH strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-99002 7.8 HIGH drm/vmwgfx: validate pitch coming from userspace
CVE-2026-98899 7.8 HIGH netfilter: ipset: mark the rcu locked areas properly
CVE-2026-99006 7.8 HIGH drm/i915/gem: Prevent overstepping exec array boundary

Showing top 20 of 217 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux