CVE-2026-98985 (GCVE-0-2026-98985)
Vulnerability from cvelistv5
Published
2026-10-23 12:20
Modified
2026-10-30 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
namespace: check the mounts before reading their parents in pivot_root()
path_pivot_root() reads the parents of new_root and of the caller's root
and checks whether they are shared before it checks that either mount is
in the caller's mount namespace. Only namespace_sem is held. That's fine
for a mount that is in the caller's mount namespace.
But new_root can be a file descriptor to a mount that has been unmounted
and that only the file descriptor keeps alive. If that mount stayed
attached to its parent when it was unmounted nothing pins the parent for
it. The final mntput() of the parent unhooks the children under
mount_lock alone and frees the parent afterwards:
pivot_root() close(fd), last ref on the parent
------------ ---------------------------------
ex_parent = new_mnt->mnt_parent
mntput_no_expire_slowpath()
__umount_mnt(new_mnt)
cleanup_mnt()
call_rcu()
IS_MNT_SHARED(ex_parent)
BUG: KASAN: slab-use-after-free in path_pivot_root+0xf1a/0x1840
Read of size 4 at addr ffff8881047382f8 by task pivot_widen/157
path_pivot_root+0xf1a/0x1840
__x64_sys_pivot_root+0x165/0x190
The same goes for the caller's root via chroot(). Both outcomes of the
check end in EINVAL so nothing but the read itself goes wrong. It's the
same thing commit bb4609405752 ("statmount: read the parent of an
unmounted mount under mount_lock") fixed for statmount().
Check that both mounts are in the caller's namespace before their
parents are read. Every path returns EINVAL either way.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: e0c9c0afd2fc958ffa34b697972721d81df8a56f Version: 84b78514033ff22c443473214ab6d0508394cf7a Version: 4.0.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43fd2e2ec66e6db26b6ea3e9e7a4c1018455e1b0",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "5b5f8d0895cfa9f781ce107225d578897203444f",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "3184a2fda996af8fcd6def36020ec023c6279015",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "a56d4f8f8f4c5d9ac339d5c03a9d90eecd3697fc",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "3c2441e21c3df867e4131e0ff784ecdb3a7a55f8",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "e3aba6900483f64e6c9eb328150dd633b7d36c1c",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "3dad2330c89343ba083cf7868779083fd5fbe0fe",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"lessThan": "6b7c001eb5857fa09041f47673666060a2e5fc1c",
"status": "affected",
"version": "e0c9c0afd2fc958ffa34b697972721d81df8a56f",
"versionType": "git"
},
{
"status": "affected",
"version": "84b78514033ff22c443473214ab6d0508394cf7a",
"versionType": "git"
},
{
"lessThan": "4.1",
"status": "affected",
"version": "4.0.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: check the mounts before reading their parents in pivot_root()\n\npath_pivot_root() reads the parents of new_root and of the caller\u0027s root\nand checks whether they are shared before it checks that either mount is\nin the caller\u0027s mount namespace. Only namespace_sem is held. That\u0027s fine\nfor a mount that is in the caller\u0027s mount namespace.\n\nBut new_root can be a file descriptor to a mount that has been unmounted\nand that only the file descriptor keeps alive. If that mount stayed\nattached to its parent when it was unmounted nothing pins the parent for\nit. The final mntput() of the parent unhooks the children under\nmount_lock alone and frees the parent afterwards:\n\n pivot_root() close(fd), last ref on the parent\n ------------ ---------------------------------\n ex_parent = new_mnt-\u003emnt_parent\n mntput_no_expire_slowpath()\n __umount_mnt(new_mnt)\n cleanup_mnt()\n call_rcu()\n IS_MNT_SHARED(ex_parent)\n\n BUG: KASAN: slab-use-after-free in path_pivot_root+0xf1a/0x1840\n Read of size 4 at addr ffff8881047382f8 by task pivot_widen/157\n path_pivot_root+0xf1a/0x1840\n __x64_sys_pivot_root+0x165/0x190\n\nThe same goes for the caller\u0027s root via chroot(). Both outcomes of the\ncheck end in EINVAL so nothing but the read itself goes wrong. It\u0027s the\nsame thing commit bb4609405752 (\"statmount: read the parent of an\nunmounted mount under mount_lock\") fixed for statmount().\n\nCheck that both mounts are in the caller\u0027s namespace before their\nparents are read. Every path returns EINVAL either way."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:40:43.386Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43fd2e2ec66e6db26b6ea3e9e7a4c1018455e1b0"
},
{
"url": "https://git.kernel.org/stable/c/5b5f8d0895cfa9f781ce107225d578897203444f"
},
{
"url": "https://git.kernel.org/stable/c/3184a2fda996af8fcd6def36020ec023c6279015"
},
{
"url": "https://git.kernel.org/stable/c/a56d4f8f8f4c5d9ac339d5c03a9d90eecd3697fc"
},
{
"url": "https://git.kernel.org/stable/c/3c2441e21c3df867e4131e0ff784ecdb3a7a55f8"
},
{
"url": "https://git.kernel.org/stable/c/e3aba6900483f64e6c9eb328150dd633b7d36c1c"
},
{
"url": "https://git.kernel.org/stable/c/3dad2330c89343ba083cf7868779083fd5fbe0fe"
},
{
"url": "https://git.kernel.org/stable/c/6b7c001eb5857fa09041f47673666060a2e5fc1c"
}
],
"title": "namespace: check the mounts before reading their parents in pivot_root()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98985",
"datePublished": "2026-10-23T12:20:03.622Z",
"dateReserved": "2026-09-25T10:25:14.384Z",
"dateUpdated": "2026-10-30T12:40:43.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…