namespace: handle mount locking for automounts correctly

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98977
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-23 13:17:19 UTC
Updated2026-10-23 13:17:19 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attach_recursive_mnt() locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying files or directories. The user namespace is taken from the caller's mount namespaces since this is where the mounts end up. Except, that's not always true. Automounts may legitimately get popped in by tasks located in a different mount and user namespace during path lookup. Then check doesn't make sense at that point. The copy in the namespace of the parent - which may be the host's - is now locked and the host cannot change the flags of its own mounts anymore. Here's the reproducer: - host has debugfs mounted nosuid,nodev,noexec and shared - tracefs automount below it is not yet active - hand a child process a directory descriptor on that mount - child process enters auser and mount namespace - child process' namespace now holds a locked copy of the host's debugfs mount that receives propagation from it - child process stats "tracing/." through the descriptor - lookup runs on the host's mount so the automount lands below the host's mount - propagation puts a copy below the child's copy - both try to clear the flags on the mount they got, with a bind remount: host, on its own automount: MS_REMOUNT|MS_BIND = EPERM child, on the copy in its namespace: MS_REMOUNT|MS_BIND = 0 So the lock landed on the host's mount instead of the child's copy. Congrats. So we need to compare with the owner of the namespace the mount actually gets mounted on. For all regular cases that is the caller's mount namespace and so nothing changes. Detached trees in anonymous mount namespaces by be handed over via SCM_RIGHTS or inherited in other ways on purpose so the attaching task's mount namespace is authoritative, not the creator of the detached tree.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 5e8f3ac8fa3d411b422ad32b9168c46a4824cc79 git Not specified
CNA Linux Linux affected 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 b3ccde78f1608836e62320428abc0e8aa9cf2329 git Not specified
CNA Linux Linux affected 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 e01c79761c7b3373e80094c5eadb21cb864fa8bc git Not specified
CNA Linux Linux affected 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 6ab37fae14196ba2262b152a7d9222c50356d278 git Not specified
CNA Linux Linux affected 132c94e31b8bca8ea921f9f96a57d684fa4ae0a9 33aadc7c72055fca93cb5a3691d836ebf8b31c9b git Not specified
CNA Linux Linux affected 9c773201d61272db49f8f33a83a3cb2a3fe4b14f git Not specified
CNA Linux Linux affected 3.8.6 3.9 semver Not specified
CNA Linux Linux affected 3.9 Not specified
CNA Linux Linux unaffected 3.9 semver Not specified
CNA Linux Linux unaffected 6.6.160 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.114 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.57 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.11 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/5e8f3ac8fa3d411b422ad32b9168c46a4824cc79 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b3ccde78f1608836e62320428abc0e8aa9cf2329 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/33aadc7c72055fca93cb5a3691d836ebf8b31c9b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6ab37fae14196ba2262b152a7d9222c50356d278 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e01c79761c7b3373e80094c5eadb21cb864fa8bc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report