CVE-2026-98994 (GCVE-0-2026-98994)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:20 – Updated: 2026-10-23 12:20
VLAI
Title
statmount: read the parent of an unmounted mount under mount_lock
Summary
In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount_lock statmount_mnt_basic() reads the ids of the parent through m->mnt_parent with namespace_sem held for reading. That's fine for a mount that is in a namespace. Everything above it is pinned by that namespace. STATMOUNT_BY_FD also accepts a file descriptor on a mount that has been unmounted on purpose and that only the file descriptor keeps alive. If that mount stayed attached to its parent when it was unmounted the parent is unmounted as well and nothing pins it for the child. The final mntput() unmounts the children under mount_lock alone and frees the parent afterwards. Concurrently, statmount_mnt_basic() reads m->mnt_parent twice while that can happen and can easily dereference a mount that's already gone. Read the parent of an unmounted mount under mount_lock. The parent can't be put while it is held and both ids come from the same mount. A mounted mount's parent is pinned by the namespace and a mount can't leave its namespace while namespace_sem is held, so the common case takes no global lock.
Severity
No CVSS data available.
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7056 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0e5032237ee5530147fbdf33134297e1490d5ec3 , < 98fc6c7b6ca676157d2c780bd0a537b2c10fe08f (git)
Affected: 0e5032237ee5530147fbdf33134297e1490d5ec3 , < bb46094057520304073130920c223451c2a694a7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.2.11 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "98fc6c7b6ca676157d2c780bd0a537b2c10fe08f",
              "status": "affected",
              "version": "0e5032237ee5530147fbdf33134297e1490d5ec3",
              "versionType": "git"
            },
            {
              "lessThan": "bb46094057520304073130920c223451c2a694a7",
              "status": "affected",
              "version": "0e5032237ee5530147fbdf33134297e1490d5ec3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstatmount: read the parent of an unmounted mount under mount_lock\n\nstatmount_mnt_basic() reads the ids of the parent through m-\u003emnt_parent\nwith namespace_sem held for reading. That\u0027s fine for a mount that is\nin a namespace. Everything above it is pinned by that namespace.\n\nSTATMOUNT_BY_FD also accepts a file descriptor on a mount that has\nbeen unmounted on purpose and that only the file descriptor keeps alive.\nIf that mount stayed attached to its parent when it was unmounted the\nparent is unmounted as well and nothing pins it for the child.\n\nThe final mntput() unmounts the children under mount_lock alone and\nfrees the parent afterwards. Concurrently, statmount_mnt_basic() reads\nm-\u003emnt_parent twice while that can happen and can easily dereference a\nmount that\u0027s already gone.\n\nRead the parent of an unmounted mount under mount_lock. The parent\ncan\u0027t be put while it is held and both ids come from the same mount. A\nmounted mount\u0027s parent is pinned by the namespace and a mount can\u0027t\nleave its namespace while namespace_sem is held, so the common case\ntakes no global lock."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:20:13.244Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/98fc6c7b6ca676157d2c780bd0a537b2c10fe08f"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb46094057520304073130920c223451c2a694a7"
        }
      ],
      "title": "statmount: read the parent of an unmounted mount under mount_lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98994",
    "datePublished": "2026-10-23T12:20:13.244Z",
    "dateReserved": "2026-09-25T10:25:14.384Z",
    "dateUpdated": "2026-10-23T12:20:13.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98994",
      "date": "2026-10-24",
      "epss": "0.00198",
      "percentile": "0.09003"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/namespace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "98fc6c7b6ca676157d2c780bd0a537b2c10fe08f",
                    "status": "affected",
                    "version": "0e5032237ee5530147fbdf33134297e1490d5ec3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bb46094057520304073130920c223451c2a694a7",
                    "status": "affected",
                    "version": "0e5032237ee5530147fbdf33134297e1490d5ec3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/namespace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstatmount: read the parent of an unmounted mount under mount_lock\n\nstatmount_mnt_basic() reads the ids of the parent through m-\u003emnt_parent\nwith namespace_sem held for reading. That\u0027s fine for a mount that is\nin a namespace. Everything above it is pinned by that namespace.\n\nSTATMOUNT_BY_FD also accepts a file descriptor on a mount that has\nbeen unmounted on purpose and that only the file descriptor keeps alive.\nIf that mount stayed attached to its parent when it was unmounted the\nparent is unmounted as well and nothing pins it for the child.\n\nThe final mntput() unmounts the children under mount_lock alone and\nfrees the parent afterwards. Concurrently, statmount_mnt_basic() reads\nm-\u003emnt_parent twice while that can happen and can easily dereference a\nmount that\u0027s already gone.\n\nRead the parent of an unmounted mount under mount_lock. The parent\ncan\u0027t be put while it is held and both ids come from the same mount. A\nmounted mount\u0027s parent is pinned by the namespace and a mount can\u0027t\nleave its namespace while namespace_sem is held, so the common case\ntakes no global lock."
          }
        ],
        "id": "CVE-2026-98994",
        "lastModified": "2026-10-23T13:17:21.550",
        "metrics": {},
        "published": "2026-10-23T13:17:21.550",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/98fc6c7b6ca676157d2c780bd0a537b2c10fe08f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bb46094057520304073130920c223451c2a694a7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.