CVE-2026-98993— namespace: don't inherit MNT_UMOUNT in clone_mnt()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： 命名空间（namespace）：在 clone_mnt() 中不再继承 MNT_UMOUNT 标志 MNT_UMOUNT 标志会在 或 将某个挂载点从其命名空间中移除时被置位，且该标志永远不会被清除。 函数对于携带该标志的挂载点，执行的是“取消链接”（unhook）操作，而非真正的卸载（unmount）。 允许已卸载的子挂载点保持连接，仅当其父挂载点携带该标志时； 则将该标志视为挂载点即将被卸载的信号，以此决定其他可卸载的挂载点、锁定挂载链的终点，以及是否需要为覆盖挂载
Affected Version Matrix 14
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 590ce4bcbfb4e0462a720a4ad901e84416080bba< 99698cfa34e493fc091219056aae446fe9442a96 |
affected |
590ce4bcbfb4e0462a720a4ad901e84416080bba< c26c1a91ad2881a194f7af543e0b57f0870006b2 |
affected | ||
590ce4bcbfb4e0462a720a4ad901e84416080bba< eecc9cd0fc07dba3f7fb0b2f844b4029435a2f7b |
affected | ||
590ce4bcbfb4e0462a720a4ad901e84416080bba< 5077b52e9e4d72da53c50251296b99cd416765a1 |
affected | ||
590ce4bcbfb4e0462a720a4ad901e84416080bba< e2c6d326216642011da318b9edfd5d57ebd5a56f |
affected | ||
7052e71b2d085f76800115d4a212dcaf82b86262 |
affected | ||
4.0.2< 4.1 |
affected | ||
4.1 |
affected | ||
| … +6 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-98993
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
namespace: don't inherit MNT_UMOUNT in clone_mnt()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
namespace: don't inherit MNT_UMOUNT in clone_mnt()
MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has
taken out of its namespace. It's never cleared. __detach_mounts()
unhooks a mount that carries it instead of unmounting it.
disconnect_mount() lets an unmounted child stay attached only if its
parent carries it. propagate_umount() takes it as the sign that a mount
is going to be unmounted when it decides what else can be unmounted,
where a chain of locked mounts ends and where a for reparenting an
overmount.
clone_mnt() copies the flags of the source and only masks
MNT_INTERNAL_FLAGS which doesn't include MNT_UMOUNT. A mount that was
lazily unmounted but is kept alive by a file descriptor can still be
copied when its root is an nsfs or pidfs file because may_copy_tree()
accepts those before checking whether the source is mounted at all:
mount --bind /proc/self/ns/net /tmp/x
exec 3< /tmp/x
umount -l /tmp/x
mount --bind /proc/self/fd/3 /tmp/y
The mount on /tmp/y is attached to the caller's namespace with
MNT_UMOUNT already set and every copy of it inherits the flag again.
That causes a number of bugs:
- Unlink its mountpoint from a mount namespace where it isn't one.
__detach_mounts() takes it for a mount that was unmounted earlier,
unhooks it from its parent and drops the reference the namespace
holds on it. It stays in the namespace with one reference too few
and as its own parent, so it can't be unmounted through the file
descriptor anymore and the namespace never finds it again. When the
namespace goes away it's leaked and points to a freed struct
mnt_namespace that may_change_propagation() and anon_ns_root() read
on the next propagation change or mount_setattr() through the file
descriptor.
- Make it shared and unmount a peer. trace_transfers() follows the
flag from the peer into it and strips it from its peer group.
- Let a propagated umount reach it. gather_candidates() marks it with
T_UMOUNT_CANDIDATE but never puts it on the candidate list, so the
mark is never cleared and every later propagated umount skips it. If
it's the parent of a locked mount handle_locked() takes it as the
cutoff and commits the locked child that should have stayed and
disconnect_mount() leaves that child attached to it, unmounted under
a mounted parent, which is what disconnect_mount() exists to
prevent. When the namespace goes away umount_tree() visits the child
a second time. And once __detach_mounts() has made it its own parent
reparent() never finds the end of the chain of unmounted parents.
A clone is a new mount that has never been unmounted. Add MNT_UMOUNT
to MNT_INTERNAL_FLAGS so clone_mnt() never copies it. And warn when
umount_tree() reaches a mount that already has it set.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-98993
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-98993
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-98993 (5)
Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total
| CVE-2026-98959 | 9.8 CRITICAL | btrfs: fix xattr replace when multiple xattrs are packed in the same item |
| CVE-2026-99079 | 9.8 CRITICAL | net/mlx5e: Prevent stale XSK buffer release on refill retry |
| CVE-2026-99078 | 9.8 CRITICAL | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry |
| CVE-2026-98870 | 8.8 HIGH | ksmbd: remove stale channels from all sessions on teardown |
| CVE-2026-98980 | 8.8 HIGH | namei: don't reveal overmounted entries in refwalk |
| CVE-2026-99083 | 8.8 HIGH | ksmbd: fix heap out-of-bounds write in krb5_authenticate() |
| CVE-2026-99082 | 8.8 HIGH | KVM: x86: Use active memslots for the per-vCPU MMIO cache |
| CVE-2026-98981 | 8.8 HIGH | namespace: unhash a dentry before detaching the mounts on it |
| CVE-2026-98988 | 8.8 HIGH | namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE |
| CVE-2026-98978 | 8.4 HIGH | namespace: never expire a locked mount |
| CVE-2026-99042 | 8.4 HIGH | io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 |
| CVE-2026-98968 | 8.1 HIGH | amt: send the relay's General Query directly from the receive path |
| CVE-2026-99064 | 8.1 HIGH | cipso: adjust cached option offsets when removing CIPSO |
| CVE-2026-99051 | 7.8 HIGH | fsverity: RCU-delay the freeing of struct fsverity_info |
| CVE-2026-99050 | 7.8 HIGH | gpio: mpsse: fix race when arming the IRQ poll worker |
| CVE-2026-98975 | 7.8 HIGH | xfs: stop exchanging reflink flags when exchanging mappings |
| CVE-2026-99053 | 7.8 HIGH | tipc: hold a reference to nodes found by link name |
| CVE-2026-99054 | 7.8 HIGH | tipc: destroy topsrv workqueues before closing connections |
| CVE-2026-98974 | 7.8 HIGH | xfs: fix exchange-range-to-eof file size exchange |
| CVE-2026-98944 | 7.8 HIGH | HID: steam: Refactor registration |
Showing top 20 of 218 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Same vendor: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()