{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98995", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.384Z", "datePublished": "2026-10-23T12:20:14.155Z", "dateUpdated": "2026-10-24T14:09:55.095Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:55.095Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: reset the old parent's ->overmount in mnt_change_mountpoint()\n\n__umount_mnt() resets ->overmount of the parent when it unmounts the\nmount that overmounts it. mnt_change_mountpoint() doesn't. It moves the\nmount to its new parent and leaves the old one pointing at it.\n\nFor a mount that is moved beneath in attach_recursive_mnt() that doesn't\nmatter. The new mount has already reset ->overmount of the old parent by\nthe time the old top mount is moved onto it.\n\nIt matters for reparent() though. propagate_umount() moves a surviving\novermount onto the first ancestor that isn't going to be unmounted. The\nmount it was taken from is unmounted immediately afterwards. If a file\ndescriptor keeps that unmounted mount alive ->overmount points at the\nmoved mount. That's a dangling pointer and UAF as the moved mount is\nunmounted and freed.\n\ndo_lock_mount() follows ->overmount from the target path under\nmount_lock. With a file descriptor on such a mount as the target of a\nmount beneath topmost_overmount() walks into the freed mount and\ndo_lock_mount() takes references on whatever it finds there.\n\nSo reset ->overmount of the old parent in mnt_change_mountpoint() the\nsame way __umount_mnt() does. A mount's ->overmount is then always a\nmount that is attached to it." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Local umount2() reaches do_umount()->umount_tree()->propagate_umount()->reparent()->mnt_change_mountpoint(), and local move_mount(MOVE_MOUNT_BENEATH) later consumes the dangling overmount; no network or physical input reaches this path.\nAC:L - The regression test deterministically creates the propagation topology, pins X_b, frees its reparented overmount, and triggers the UAF; no race or external state is required, and any mount-cache grooming is attacker-controlled.\nPR:L - can_umount() and move_mount() require may_mount(), but the test's unshare(CLONE_NEWUSER|CLONE_NEWNS) gives an ordinary local user CAP_SYS_ADMIN in the child mount namespace, satisfying every mount-operation gate without init-namespace root.\nUI:N - The attacker personally creates the shared/private tmpfs mounts, opens the O_PATH descriptor, performs both lazy unmounts, and invokes move_mount(); no victim must mount, open, or otherwise act on anything.\nS:U - The dangling struct mount created by mnt_change_mountpoint() corrupts the same host kernel that enforces the attacker's mount namespace; this is ordinary kernel privilege escalation, not a VM, hypervisor, or IOMMU boundary crossing.\nC:H - topmost_overmount() reads freed struct mount contents, and where_to_mount() then consumes its stale overmount, mnt_mountpoint, and mnt_parent pointers; reclaiming the mnt_cache object permits redirected kernel-memory accesses and high-impact disclosure.\nI:H - do_lock_mount() calls mntget() and dget() through the freed mount-derived pointers, causing reference-count writes through stale mnt_pcp and dentry state; mount-cache reclamation and heap grooming can turn these UAF writes into control-flow corruption.\nA:H - Following the freed overmount and then dereferencing or locking the stale dentry->d_inode can produce a kernel UAF oops or panic, and the complete mount/unmount/move_mount sequence is repeatable by the same unprivileged process." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/namespace.c" ], "versions": [ { "version": "ffdc52fbbd5835a936ad683c943d6d103a2d4514", "lessThan": "5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5", "status": "affected", "versionType": "git" }, { "version": "ffdc52fbbd5835a936ad683c943d6d103a2d4514", "lessThan": "08d575ee89393fd812dbdca7b5d7b4574cd5a564", "status": "affected", "versionType": "git" }, { "version": "ffdc52fbbd5835a936ad683c943d6d103a2d4514", "lessThan": "476ef286a7a5db8bda51325dc0c45887b4d99d9a", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/namespace.c" ], "versions": [ { "version": "6.17", "status": "affected" }, { "version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5" }, { "url": "https://git.kernel.org/stable/c/08d575ee89393fd812dbdca7b5d7b4574cd5a564" }, { "url": "https://git.kernel.org/stable/c/476ef286a7a5db8bda51325dc0c45887b4d99d9a" } ], "title": "namespace: reset the old parent's ->overmount in mnt_change_mountpoint()", "x_generator": { "engine": "bippy-1.2.0" } } } }