CVE-2026-98995— Linux 内核 mnt_change_mountpoint 越界漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 Linux 内核中，以下漏洞已被修复： 命名空间：在 中重置旧父节点的 指针。 在卸载覆盖其父节点的挂载点时，会重置该父节点的 指针。然而， 并未执行此操作：它将挂载点移动到新父节点下，却使旧父节点的 指针仍然指向该已移动的挂载点。 对于在 中被移动至其他挂载点之下的情况，这并无影响，因为当旧的顶层挂载点被移动到新挂载点上时，新挂载点早已重置了旧父节点的 指针。 但对于 函数而言，这确实存在问题。 会将一个幸存的覆盖挂载（overmount）移动至第一个不会被卸载的祖先挂载点，随后立即卸载其来源挂载点。若此时有
影响版本矩阵 8
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | ffdc52fbbd5835a936ad683c943d6d103a2d4514< 5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5 |
affected |
ffdc52fbbd5835a936ad683c943d6d103a2d4514< 08d575ee89393fd812dbdca7b5d7b4574cd5a564 |
affected | ||
ffdc52fbbd5835a936ad683c943d6d103a2d4514< 476ef286a7a5db8bda51325dc0c45887b4d99d9a |
affected | ||
6.17 |
affected | ||
< 6.17 |
unaffected | ||
6.18.57≤ 6.18.* |
unaffected | ||
7.2.11≤ 7.2.* |
unaffected | ||
7.3≤ * |
unaffected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-98995 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
namespace: reset the old parent's ->overmount in mnt_change_mountpoint()
__umount_mnt() resets ->overmount of the parent when it unmounts the
mount that overmounts it. mnt_change_mountpoint() doesn't. It moves the
mount to its new parent and leaves the old one pointing at it.
For a mount that is moved beneath in attach_recursive_mnt() that doesn't
matter. The new mount has already reset ->overmount of the old parent by
the time the old top mount is moved onto it.
It matters for reparent() though. propagate_umount() moves a surviving
overmount onto the first ancestor that isn't going to be unmounted. The
mount it was taken from is unmounted immediately afterwards. If a file
descriptor keeps that unmounted mount alive ->overmount points at the
moved mount. That's a dangling pointer and UAF as the moved mount is
unmounted and freed.
do_lock_mount() follows ->overmount from the target path under
mount_lock. With a file descriptor on such a mount as the target of a
mount beneath topmost_overmount() walks into the freed mount and
do_lock_mount() takes references on whatever it finds there.
So reset ->overmount of the old parent in mnt_change_mountpoint() the
same way __umount_mnt() does. A mount's ->overmount is then always a
mount that is attached to it.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-98995 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-98995 的情报信息
请登录查看更多情报信息。
CVE-2026-98995 补丁与修复 (3)
同批安全公告 · Linux · 2026-10-23 · 共 218 条
| CVE-2026-98959 | 9.8 CRITICAL | btrfs 扩展属性替换处理远程代码执行漏洞 |
| CVE-2026-99079 | 9.8 CRITICAL | Mellanox mlx5e 驱动 XSK 缓冲区释放漏洞 |
| CVE-2026-99078 | 9.8 CRITICAL | Mellanox mlx5e MPWQE重试时XSK缓冲区释放漏洞 |
| CVE-2026-98870 | 8.8 HIGH | ksmbd 会话清理时存在通道移除逻辑漏洞 |
| CVE-2026-98980 | 8.8 HIGH | namei 遍历中过度挂载条目信息泄露漏洞 |
| CVE-2026-99083 | 8.8 HIGH | ksmbd 的 krb5_authenticate() 函数堆越界写漏洞 |
| CVE-2026-99082 | 8.8 HIGH | KVM x86 内存管理漏洞 |
| CVE-2026-98981 | 8.8 HIGH | Linux 内核命名空间 dentry 解挂载前未哈希漏洞 |
| CVE-2026-98988 | 8.8 HIGH | Linux 5.13 命名空间越界漏洞 |
| CVE-2026-98978 | 8.4 HIGH | Linux 命名空间 锁定挂载永不失效漏洞 |
| CVE-2026-99042 | 8.4 HIGH | io_uring 24 字节 sockaddr_in6 过滤字段填充漏洞 |
| CVE-2026-98968 | 8.1 HIGH | AMT 中继通用查询远程代码执行漏洞 |
| CVE-2026-99064 | 8.1 HIGH | CIPSO 缓存选项偏移调整漏洞 |
| CVE-2026-99051 | 7.8 HIGH | fsverity 信息结构释放延迟漏洞 |
| CVE-2026-99050 | 7.8 HIGH | GPIO MPSSE 驱动 IRQ 轮询竞态漏洞 |
| CVE-2026-98975 | 7.8 HIGH | XFS 文件系统 reflink 标志交换逻辑漏洞 |
| CVE-2026-99053 | 7.8 HIGH | Linux TIPC 节点引用漏洞 |
| CVE-2026-99054 | 7.8 HIGH | Linux TIPC 拓扑服务队列资源泄漏漏洞 |
| CVE-2026-98974 | 7.8 HIGH | XFS 文件系统范围交换到文件末尾大小漏洞 |
| CVE-2026-98944 | 7.8 HIGH | Steam HID 注册重构漏洞 |
显示前 20 条，共 218 条。 查看全部 → →