CVE-2026-98983 (GCVE-0-2026-98983)
Vulnerability from cvelistv5
Published
2026-10-23 12:20
Modified
2026-10-23 12:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
unshare: don't drop active namespace references that were never taken
Active references on the namespaces of an nsproxy are taken when the
nsproxy is installed into a task in switch_task_namespaces() and
copy_namespaces() and dropped again by put_nsproxy() through
deactivate_nsproxy().
But ksys_unshare() calls put_nsproxy() on an nsproxy that was never
installed when set_cred_ucounts() fails. The new namespaces of that
nsproxy go from zero to minus one and the namespaces shared with the
caller lose a reference that belongs to the nsproxy the caller keeps
using:
WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230
nsproxy_ns_active_put
deactivate_nsproxy
ksys_unshare
Afterwards the namespaces the caller lives in aren't listed by listns()
anymore. set_cred_ucounts() only fails when alloc_ucounts() can't
allocate and it only allocates when the real uid of the caller differs
from its effective uid.
Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify
create_new_namespaces()") separated the two cases on purpose.
nsproxy_free() frees an nsproxy that was prepared but never installed
and that's what a failed setns() uses in put_nsset(). Export it and use
it for a failed unshare() as well.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a98621a0f187a934c115dcfe79a49520ae892111 Version: a98621a0f187a934c115dcfe79a49520ae892111 Version: 27ae6b17c9ba7ff353ab0906297f08aa845782b4 Version: 297261b343371c4f0b31055d53d285138ec21565 Version: 813a47b0309097da71781ee4ac11922e39b67d55 Version: 6e608e3e5ce12ce7fd21e46212eccca37f917d0e Version: a261fccdb4ac58ec5ba6aa1d92a6cc418fff301f Version: 665dc1ed16357988d439fc5bbc860ee36f540d81 Version: 5.15.209 ≤ Version: 6.1.175 ≤ Version: 6.6.141 ≤ Version: 6.12.91 ≤ Version: 6.18.33 ≤ Version: 7.0.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/nsproxy.h",
"kernel/fork.c",
"kernel/nsproxy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "56fe03a0c05dba4c5f6a23c391f96de1614a098c",
"status": "affected",
"version": "a98621a0f187a934c115dcfe79a49520ae892111",
"versionType": "git"
},
{
"lessThan": "0b6f31a3c0b16066f812e94b52a704174a6f23cd",
"status": "affected",
"version": "a98621a0f187a934c115dcfe79a49520ae892111",
"versionType": "git"
},
{
"status": "affected",
"version": "27ae6b17c9ba7ff353ab0906297f08aa845782b4",
"versionType": "git"
},
{
"status": "affected",
"version": "297261b343371c4f0b31055d53d285138ec21565",
"versionType": "git"
},
{
"status": "affected",
"version": "813a47b0309097da71781ee4ac11922e39b67d55",
"versionType": "git"
},
{
"status": "affected",
"version": "6e608e3e5ce12ce7fd21e46212eccca37f917d0e",
"versionType": "git"
},
{
"status": "affected",
"version": "a261fccdb4ac58ec5ba6aa1d92a6cc418fff301f",
"versionType": "git"
},
{
"status": "affected",
"version": "665dc1ed16357988d439fc5bbc860ee36f540d81",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThan": "6.13",
"status": "affected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThan": "6.19",
"status": "affected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/nsproxy.h",
"kernel/fork.c",
"kernel/nsproxy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.18.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nunshare: don\u0027t drop active namespace references that were never taken\n\nActive references on the namespaces of an nsproxy are taken when the\nnsproxy is installed into a task in switch_task_namespaces() and\ncopy_namespaces() and dropped again by put_nsproxy() through\ndeactivate_nsproxy().\n\nBut ksys_unshare() calls put_nsproxy() on an nsproxy that was never\ninstalled when set_cred_ucounts() fails. The new namespaces of that\nnsproxy go from zero to minus one and the namespaces shared with the\ncaller lose a reference that belongs to the nsproxy the caller keeps\nusing:\n\n WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230\n nsproxy_ns_active_put\n deactivate_nsproxy\n ksys_unshare\n\nAfterwards the namespaces the caller lives in aren\u0027t listed by listns()\nanymore. set_cred_ucounts() only fails when alloc_ucounts() can\u0027t\nallocate and it only allocates when the real uid of the caller differs\nfrom its effective uid.\n\nCommit cefd55bd2159 (\"nsproxy: fix free_nsproxy() and simplify\ncreate_new_namespaces()\") separated the two cases on purpose.\nnsproxy_free() frees an nsproxy that was prepared but never installed\nand that\u0027s what a failed setns() uses in put_nsset(). Export it and use\nit for a failed unshare() as well."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:20:00.918Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/56fe03a0c05dba4c5f6a23c391f96de1614a098c"
},
{
"url": "https://git.kernel.org/stable/c/0b6f31a3c0b16066f812e94b52a704174a6f23cd"
}
],
"title": "unshare: don\u0027t drop active namespace references that were never taken",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98983",
"datePublished": "2026-10-23T12:20:00.918Z",
"dateReserved": "2026-09-25T10:25:14.384Z",
"dateUpdated": "2026-10-23T12:20:00.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…