CVE-2026-98996 (GCVE-0-2026-98996)
Vulnerability from cvelistv5
Published
2026-10-23 12:20
Modified
2026-10-23 12:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs: don't silently unmount busy mounts
The propagate_mount_busy() helper exists to decide whether a synchronous
can suceed. It does that by looking at the copies of the victims in the
mounts its parent propagates to. One of those functions from propagation
hell.
It skips a copy that has child mounts except for the case of a single
child mount covering the copy's root. That algorithm used to be exact.
It isn't anymore.
Originally only childless copies were unmounted during propagation.
And 1064f874abc0 ("mnt: Tuck mounts under others instead of creating
shadow/side mounts.") ended up adding covered mounts to both sides in
one go.
Along came 99b19d16471e ("mnt: In propgate_umount handle visiting mounts
in any order") and that started to unmount more than before:
[1]: A copy of a mount is unmounted when each of its children is either
its overmount or a copy of the victim itself. In the former case
the overmount gets reparented. In the latter case the copy of the
victim will end up being unmounted.
So propagate_umount() ended up being rewritten without adjusting
propagate_mount_busy(). And currently propagate_mount_busy() doesn't
look at copies of the victim that have two or more children nor a single
child that is not the overmount.
So any such copy in [1] is not checked for
references. The result is that a synchronous unmount succeeds, pulling
out a mount that is still in use.
A container can run into this with its own mounts. The host shares a
tree with the container and the host has a mount in that tree:
mount -t tmpfs none /mnt
mount --make-shared /mnt
mount -t tmpfs none /mnt/a
The container's /mnt is a slave copy of the host mount. The container
now takes a detached copy of the tree and mounts that copy beneath its
propagated copy of /mnt/a and keeps the file descriptor to the tree
open:
unshare -m --propagation unchanged
mount --make-rslave /
fd = open_tree(AT_FDCWD, "/mnt", OPEN_TREE_CLONE | AT_RECURSIVE)
move_mount(fd, "", AT_FDCWD, "/mnt/a", MOVE_MOUNT_BENEATH)
grep /mnt /proc/self/mountinfo
775 355 ... /mnt ... master:646
777 775 ... /mnt/a ... master:646
776 777 ... /mnt/a ... master:647
778 777 ... /mnt/a/a ... master:647
The now attached tree (777) is now mounted beneath the container's copy
of /mnt/a. That's also where the host mount sits (as seen from the host
mount namespace). So the propagated copy (776) of the host's mount is on
top of its root and the copy of that (778) is inside it. Now the host
runs:
umount /mnt/a
and it succeeds. The moved tree tree and the copy inside of it are gone
from the container. Now only the propagated copy is left and it got
reparented to where it was before:
grep /mnt /proc/self/mountinfo
775 355 ... /mnt ... master:646
776 775 ... /mnt/a ...
But the file descriptor still refers to the moved tree. So a synchronous
umount detached a mount that is still in use.
Teach propagate_mount_busy() the same checks that propagate_umount()
does. It now checks for a single victim mount without children
for which it can assume that MNT_LOCKED is cleared on every copy like
propagate_umount() does. The copies form chains. IOW, when a copy itself
receives propagation from the victim's parent then the mount at the same
mountpoint inside that copy is a copy as well. Whether a mount receives
propagation from the victim's can simply be checked by walking its
masters. Walk each chain once from its top so we are sure that nested
copies stay linear. Check every reference once of every copy that gets
unmounted.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 Version: 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 Version: 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 Version: dc5ce95b0252d143497283f7f659840d4f8a79d0 Version: fdb8f10499924d96b8eb60cc1354b278f6fcf0e9 Version: bb4fbf094b440a9209ed88c8681960d4b26eec0f Version: b43f81ef0babcc07db1eaaece37c989204e4ff00 Version: 81311d1698c0c87c972ba71d3ce44a617b52ea21 Version: 4.1.43 ≤ Version: 4.4.78 ≤ Version: 4.9.39 ≤ Version: 4.11.12 ≤ Version: 4.12.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/pnode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf2c8dec26fb792876b5e9bde7030c45d8be3908",
"status": "affected",
"version": "99b19d16471e9c3faa85cad38abc9cbbe04c6d55",
"versionType": "git"
},
{
"lessThan": "a210ac218c307513d43e98a08f23c2dfbeeebc2f",
"status": "affected",
"version": "99b19d16471e9c3faa85cad38abc9cbbe04c6d55",
"versionType": "git"
},
{
"lessThan": "6857e209015f95be7a8f19a9cd5dac345b9b9859",
"status": "affected",
"version": "99b19d16471e9c3faa85cad38abc9cbbe04c6d55",
"versionType": "git"
},
{
"status": "affected",
"version": "dc5ce95b0252d143497283f7f659840d4f8a79d0",
"versionType": "git"
},
{
"status": "affected",
"version": "fdb8f10499924d96b8eb60cc1354b278f6fcf0e9",
"versionType": "git"
},
{
"status": "affected",
"version": "bb4fbf094b440a9209ed88c8681960d4b26eec0f",
"versionType": "git"
},
{
"status": "affected",
"version": "b43f81ef0babcc07db1eaaece37c989204e4ff00",
"versionType": "git"
},
{
"status": "affected",
"version": "81311d1698c0c87c972ba71d3ce44a617b52ea21",
"versionType": "git"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.43",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.78",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.39",
"versionType": "semver"
},
{
"lessThan": "4.12",
"status": "affected",
"version": "4.11.12",
"versionType": "semver"
},
{
"lessThan": "4.13",
"status": "affected",
"version": "4.12.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/pnode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.11.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.12.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: don\u0027t silently unmount busy mounts\n\nThe propagate_mount_busy() helper exists to decide whether a synchronous\ncan suceed. It does that by looking at the copies of the victims in the\nmounts its parent propagates to. One of those functions from propagation\nhell.\n\nIt skips a copy that has child mounts except for the case of a single\nchild mount covering the copy\u0027s root. That algorithm used to be exact.\nIt isn\u0027t anymore.\n\nOriginally only childless copies were unmounted during propagation.\nAnd 1064f874abc0 (\"mnt: Tuck mounts under others instead of creating\nshadow/side mounts.\") ended up adding covered mounts to both sides in\none go.\n\nAlong came 99b19d16471e (\"mnt: In propgate_umount handle visiting mounts\nin any order\") and that started to unmount more than before:\n\n[1]: A copy of a mount is unmounted when each of its children is either\n its overmount or a copy of the victim itself. In the former case\n the overmount gets reparented. In the latter case the copy of the\n victim will end up being unmounted.\n\nSo propagate_umount() ended up being rewritten without adjusting\npropagate_mount_busy(). And currently propagate_mount_busy() doesn\u0027t\nlook at copies of the victim that have two or more children nor a single\nchild that is not the overmount.\n\nSo any such copy in [1] is not checked for\nreferences. The result is that a synchronous unmount succeeds, pulling\nout a mount that is still in use.\n\nA container can run into this with its own mounts. The host shares a\ntree with the container and the host has a mount in that tree:\n\n mount -t tmpfs none /mnt\n mount --make-shared /mnt\n mount -t tmpfs none /mnt/a\n\nThe container\u0027s /mnt is a slave copy of the host mount. The container\nnow takes a detached copy of the tree and mounts that copy beneath its\npropagated copy of /mnt/a and keeps the file descriptor to the tree\nopen:\n\n unshare -m --propagation unchanged\n mount --make-rslave /\n fd = open_tree(AT_FDCWD, \"/mnt\", OPEN_TREE_CLONE | AT_RECURSIVE)\n move_mount(fd, \"\", AT_FDCWD, \"/mnt/a\", MOVE_MOUNT_BENEATH)\n\n grep /mnt /proc/self/mountinfo\n 775 355 ... /mnt ... master:646\n 777 775 ... /mnt/a ... master:646\n 776 777 ... /mnt/a ... master:647\n 778 777 ... /mnt/a/a ... master:647\n\nThe now attached tree (777) is now mounted beneath the container\u0027s copy\nof /mnt/a. That\u0027s also where the host mount sits (as seen from the host\nmount namespace). So the propagated copy (776) of the host\u0027s mount is on\ntop of its root and the copy of that (778) is inside it. Now the host\nruns:\n\n umount /mnt/a\n\nand it succeeds. The moved tree tree and the copy inside of it are gone\nfrom the container. Now only the propagated copy is left and it got\nreparented to where it was before:\n\n grep /mnt /proc/self/mountinfo\n 775 355 ... /mnt ... master:646\n 776 775 ... /mnt/a ...\n\nBut the file descriptor still refers to the moved tree. So a synchronous\numount detached a mount that is still in use.\n\nTeach propagate_mount_busy() the same checks that propagate_umount()\ndoes. It now checks for a single victim mount without children\nfor which it can assume that MNT_LOCKED is cleared on every copy like\npropagate_umount() does. The copies form chains. IOW, when a copy itself\nreceives propagation from the victim\u0027s parent then the mount at the same\nmountpoint inside that copy is a copy as well. Whether a mount receives\npropagation from the victim\u0027s can simply be checked by walking its\nmasters. Walk each chain once from its top so we are sure that nested\ncopies stay linear. Check every reference once of every copy that gets\nunmounted."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T12:20:15.188Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf2c8dec26fb792876b5e9bde7030c45d8be3908"
},
{
"url": "https://git.kernel.org/stable/c/a210ac218c307513d43e98a08f23c2dfbeeebc2f"
},
{
"url": "https://git.kernel.org/stable/c/6857e209015f95be7a8f19a9cd5dac345b9b9859"
}
],
"title": "fs: don\u0027t silently unmount busy mounts",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98996",
"datePublished": "2026-10-23T12:20:15.188Z",
"dateReserved": "2026-09-25T10:25:14.384Z",
"dateUpdated": "2026-10-23T12:20:15.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…