{"api_version":"1","generated_at":"2026-10-28T16:52:40+00:00","cve":"CVE-2026-98979","urls":{"html":"https://cve.report/CVE-2026-98979","api":"https://cve.report/api/cve/CVE-2026-98979.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98979","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98979"},"summary":{"title":"namespace: refuse an automount below a mount that is in no namespace","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: refuse an automount below a mount that is in no namespace\n\nIt's possible to add autmounts even when the parent mount isn't in the\nmount namespace of the caller. The only requirement we have is that the\nparent mount namespace must not be NULL, i.e., unmounted.\n\nProblem is that clone_private_mount() has MNT_NS_INTERNAL which makes\nthat trivially true. So that passes the test and attach_recursive_mnt()\naccepts that as a mount point and funny enough, count_mounts()\ndereferences MNT_NS_INTERNAL. The problem is it is an error pointer...\n\nSo we can reach this in userspace via fanotify. A filesystem mark on the\nlower filesystem of an overlay reports paths on the layer clone and\nreading the event hands out a descriptor on it. For example with debugfs\nas the lower layer it goes kaboom:\n\n  openat(evfd, \"tracing\", O_DIRECTORY)\n\n  Oops: general protection fault\n  KASAN: null-ptr-deref in range [0x1d0-0x1d7]\n  RIP: 0010:count_mounts+0x35/0x200\n   attach_recursive_mnt\n   finish_automount\n\nAnd since that sleeping beauty happens under namespace_sem held for\nwriting every mount operation on the system blocks from then on.\nCongrats.\n\nUse is_mounted() instead which rejects unmounted and internal mounts\nalike. The open fails with EINVAL just as it did before\nclone_private_mount() used MNT_NS_INTERNAL.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-23 13:17:19","updated_at":"2026-10-23 13:17:19"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/776e20e4fdc23c23687b511ffdc80047878049d3","name":"https://git.kernel.org/stable/c/776e20e4fdc23c23687b511ffdc80047878049d3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ba985ce08471c555af2a2fbe217c1bc2e72a6d8c","name":"https://git.kernel.org/stable/c/ba985ce08471c555af2a2fbe217c1bc2e72a6d8c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/494c57572d2d5bc2839553ed41aabe92ed0f587c","name":"https://git.kernel.org/stable/c/494c57572d2d5bc2839553ed41aabe92ed0f587c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/35f2013f83ef16f9f0331c4c3a8e8d161580d574","name":"https://git.kernel.org/stable/c/35f2013f83ef16f9f0331c4c3a8e8d161580d574","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/95fb7c259b86f5521f04973040ad492f2bef6f82","name":"https://git.kernel.org/stable/c/95fb7c259b86f5521f04973040ad492f2bef6f82","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98979","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98979","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected df820f8de4e481222b17f9bcee7b909ae8167529 95fb7c259b86f5521f04973040ad492f2bef6f82 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected df820f8de4e481222b17f9bcee7b909ae8167529 35f2013f83ef16f9f0331c4c3a8e8d161580d574 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected df820f8de4e481222b17f9bcee7b909ae8167529 494c57572d2d5bc2839553ed41aabe92ed0f587c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected df820f8de4e481222b17f9bcee7b909ae8167529 776e20e4fdc23c23687b511ffdc80047878049d3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected df820f8de4e481222b17f9bcee7b909ae8167529 ba985ce08471c555af2a2fbe217c1bc2e72a6d8c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.8","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.8 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.160 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.113 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.57 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.11 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/namespace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"95fb7c259b86f5521f04973040ad492f2bef6f82","status":"affected","version":"df820f8de4e481222b17f9bcee7b909ae8167529","versionType":"git"},{"lessThan":"35f2013f83ef16f9f0331c4c3a8e8d161580d574","status":"affected","version":"df820f8de4e481222b17f9bcee7b909ae8167529","versionType":"git"},{"lessThan":"494c57572d2d5bc2839553ed41aabe92ed0f587c","status":"affected","version":"df820f8de4e481222b17f9bcee7b909ae8167529","versionType":"git"},{"lessThan":"776e20e4fdc23c23687b511ffdc80047878049d3","status":"affected","version":"df820f8de4e481222b17f9bcee7b909ae8167529","versionType":"git"},{"lessThan":"ba985ce08471c555af2a2fbe217c1bc2e72a6d8c","status":"affected","version":"df820f8de4e481222b17f9bcee7b909ae8167529","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/namespace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.113","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.160","versionStartIncluding":"5.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.113","versionStartIncluding":"5.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.57","versionStartIncluding":"5.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.11","versionStartIncluding":"5.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"5.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: refuse an automount below a mount that is in no namespace\n\nIt's possible to add autmounts even when the parent mount isn't in the\nmount namespace of the caller. The only requirement we have is that the\nparent mount namespace must not be NULL, i.e., unmounted.\n\nProblem is that clone_private_mount() has MNT_NS_INTERNAL which makes\nthat trivially true. So that passes the test and attach_recursive_mnt()\naccepts that as a mount point and funny enough, count_mounts()\ndereferences MNT_NS_INTERNAL. The problem is it is an error pointer...\n\nSo we can reach this in userspace via fanotify. A filesystem mark on the\nlower filesystem of an overlay reports paths on the layer clone and\nreading the event hands out a descriptor on it. For example with debugfs\nas the lower layer it goes kaboom:\n\n  openat(evfd, \"tracing\", O_DIRECTORY)\n\n  Oops: general protection fault\n  KASAN: null-ptr-deref in range [0x1d0-0x1d7]\n  RIP: 0010:count_mounts+0x35/0x200\n   attach_recursive_mnt\n   finish_automount\n\nAnd since that sleeping beauty happens under namespace_sem held for\nwriting every mount operation on the system blocks from then on.\nCongrats.\n\nUse is_mounted() instead which rejects unmounted and internal mounts\nalike. The open fails with EINVAL just as it did before\nclone_private_mount() used MNT_NS_INTERNAL."}],"providerMetadata":{"dateUpdated":"2026-10-23T12:19:52.523Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/95fb7c259b86f5521f04973040ad492f2bef6f82"},{"url":"https://git.kernel.org/stable/c/35f2013f83ef16f9f0331c4c3a8e8d161580d574"},{"url":"https://git.kernel.org/stable/c/494c57572d2d5bc2839553ed41aabe92ed0f587c"},{"url":"https://git.kernel.org/stable/c/776e20e4fdc23c23687b511ffdc80047878049d3"},{"url":"https://git.kernel.org/stable/c/ba985ce08471c555af2a2fbe217c1bc2e72a6d8c"}],"title":"namespace: refuse an automount below a mount that is in no namespace","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98979","datePublished":"2026-10-23T12:19:52.523Z","dateReserved":"2026-09-25T10:25:14.383Z","dateUpdated":"2026-10-23T12:19:52.523Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-23 13:17:19","lastModifiedDate":"2026-10-23 13:17:19","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98979","Ordinal":"1","Title":"namespace: refuse an automount below a mount that is in no names","CVE":"CVE-2026-98979","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98979","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: refuse an automount below a mount that is in no namespace\n\nIt's possible to add autmounts even when the parent mount isn't in the\nmount namespace of the caller. The only requirement we have is that the\nparent mount namespace must not be NULL, i.e., unmounted.\n\nProblem is that clone_private_mount() has MNT_NS_INTERNAL which makes\nthat trivially true. So that passes the test and attach_recursive_mnt()\naccepts that as a mount point and funny enough, count_mounts()\ndereferences MNT_NS_INTERNAL. The problem is it is an error pointer...\n\nSo we can reach this in userspace via fanotify. A filesystem mark on the\nlower filesystem of an overlay reports paths on the layer clone and\nreading the event hands out a descriptor on it. For example with debugfs\nas the lower layer it goes kaboom:\n\n  openat(evfd, \"tracing\", O_DIRECTORY)\n\n  Oops: general protection fault\n  KASAN: null-ptr-deref in range [0x1d0-0x1d7]\n  RIP: 0010:count_mounts+0x35/0x200\n   attach_recursive_mnt\n   finish_automount\n\nAnd since that sleeping beauty happens under namespace_sem held for\nwriting every mount operation on the system blocks from then on.\nCongrats.\n\nUse is_mounted() instead which rejects unmounted and internal mounts\nalike. The open fails with EINVAL just as it did before\nclone_private_mount() used MNT_NS_INTERNAL.","Type":"Description","Title":"namespace: refuse an automount below a mount that is in no names"}]}}}