Vulnerability-Lookup

CVE-2026-98978 (GCVE-0-2026-98978)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:19 – Updated: 2026-10-24 14:09

Title

namespace: never expire a locked mount

Summary

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. do_umount() refuses to unmount locked mounts but shrink_submounts() doesn't. A shrinkable mount can become locked once the owner of a user namespace puts it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked property now moves to the mount at the bottom making it possible to unmount the top mount. So umount() of an unlocked ancestor now expires the bottom mount first and the covered directory is revealed: move_mount(c -> x/hidden, MOVE_MOUNT_BENEATH) = 0 the cover after the lock moved: umount2(x/hidden) = 0 the holder of the lock: umount2(x/hidden) = EINVAL the root of the copy, busy: umount2(x) = EBUSY reads x/hidden/secret: "covered-by-root" So leave a locked mount alone as it dies together with its parent. A plain umount() of an unlocked mount with a locked one below it is EBUSY from now on. It's the same for any other locked child. A lazy umount still takes the whole tree. mark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree() leaves a mount on an expiry list alone and nothing else puts a locked one on such a list. Add an assert for this.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7061 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/6b8dc3713a76346d2…
https://git.kernel.org/stable/c/d23265a12e4991ce7…
https://git.kernel.org/stable/c/f78ddcc872248c7aa…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942 , < 6b8dc3713a76346d212abab46cbfc8d7070f534c (git) Affected: 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942 , < d23265a12e4991ce7aedce670c0b6b598cadb644 (git) Affected: 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942 , < f78ddcc872248c7aa1d7e904928441a0be4c6d5d (git)	guessed
Linux	Linux	Affected: 3.12 Unaffected: 0 , < 3.12 (semver) Unaffected: 6.18.57 , ≤ 6.18.* (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b8dc3713a76346d212abab46cbfc8d7070f534c",
              "status": "affected",
              "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
              "versionType": "git"
            },
            {
              "lessThan": "d23265a12e4991ce7aedce670c0b6b598cadb644",
              "status": "affected",
              "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
              "versionType": "git"
            },
            {
              "lessThan": "f78ddcc872248c7aa1d7e904928441a0be4c6d5d",
              "status": "affected",
              "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: never expire a locked mount\n\nLocked mounts are special. They protect the underlying files and\ndirectories from being revealed. do_umount() refuses to unmount locked\nmounts but shrink_submounts() doesn\u0027t.\n\nA shrinkable mount can become locked once the owner of a user namespace\nputs it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked\nproperty now moves to the mount at the bottom making it possible to\nunmount the top mount.\n\nSo umount() of an unlocked ancestor now expires the bottom mount first\nand the covered directory is revealed:\n\n  move_mount(c -\u003e x/hidden, MOVE_MOUNT_BENEATH) = 0\n  the cover after the lock moved:  umount2(x/hidden) = 0\n  the holder of the lock:          umount2(x/hidden) = EINVAL\n  the root of the copy, busy:      umount2(x) = EBUSY\n  reads x/hidden/secret: \"covered-by-root\"\n\nSo leave a locked mount alone as it dies together with its parent. A\nplain umount() of an unlocked mount with a locked one below it is EBUSY\nfrom now on. It\u0027s the same for any other locked child. A lazy umount\nstill takes the whole tree.\n\nmark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree()\nleaves a mount on an expiry list alone and nothing else puts a locked\none on such a list. Add an assert for this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - umount2() reaches ksys_umount() -\u003e path_umount() -\u003e do_umount() -\u003e shrink_submounts() -\u003e the patched shrink_submount(); all triggering state is supplied through local mount syscalls, not a network protocol.\nAC:L - fuse_dentry_automount() can create an attacker-controlled mount that finish_automount() marks MNT_SHRINKABLE, and clone_mnt() preserves that flag. The lock transfer with MOVE_MOUNT_BENEATH and ancestor umount2() are deterministic and require no race.\nPR:L - move_mount() and can_umount() require may_mount(), which checks CAP_SYS_ADMIN in the mount namespace\u0027s owning user namespace. An ordinary user obtains that capability through unshare(CLONE_NEWUSER|CLONE_NEWNS), as exercised by expiry_child().\nUI:N - The attacker independently performs unshare(), bind mounts, move_mount(MOVE_MOUNT_BENEATH), umount2(), and the final file access; no victim action is needed after the sandbox mount layout exists.\nS:C - MNT_LOCKED is applied by lock_mnt_tree() specifically to stop a less-privileged child user/mount namespace from exposing resources hidden by its parent; removing that cover crosses this sandbox boundary.\nC:H - Vulnerable shrink_submount() calls umount_tree() on the locked mount, causing path lookup to fall through to the entire concealed directory subtree rather than a bounded datum; in a same-identity sandbox this can disclose all files protected solely by the mount cover.\nI:H - The same umount_tree() operation exposes every object below the covered directory; where the mount namespace was the access-control boundary for a same-identity sandbox, the attacker can modify or delete the entire otherwise-hidden writable subtree.\nA:N - The flaw neither corrupts memory nor crashes or hangs the kernel; umount_tree() detaches a mount from the attacker\u0027s copied mount namespace, and the demonstrated consequence is exposure of the covered path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:09:47.444Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6b8dc3713a76346d212abab46cbfc8d7070f534c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d23265a12e4991ce7aedce670c0b6b598cadb644"
        },
        {
          "url": "https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"
        }
      ],
      "title": "namespace: never expire a locked mount",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98978",
    "datePublished": "2026-10-23T12:19:51.428Z",
    "dateReserved": "2026-09-25T10:25:14.383Z",
    "dateUpdated": "2026-10-24T14:09:47.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98978",
      "date": "2026-10-24",
      "epss": "0.00206",
      "percentile": "0.1015"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-24T01:10:41.000Z",
      "cve": "CVE-2026-98978",
      "id": "msrc_CVE-2026-98978",
      "initial_release_date": "2026-10-24T01:10:41.000Z",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "namespace: never expire a locked mount",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98978.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/namespace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6b8dc3713a76346d212abab46cbfc8d7070f534c",
                    "status": "affected",
                    "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d23265a12e4991ce7aedce670c0b6b598cadb644",
                    "status": "affected",
                    "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f78ddcc872248c7aa1d7e904928441a0be4c6d5d",
                    "status": "affected",
                    "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/namespace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.12"
                  },
                  {
                    "lessThan": "3.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: never expire a locked mount\n\nLocked mounts are special. They protect the underlying files and\ndirectories from being revealed. do_umount() refuses to unmount locked\nmounts but shrink_submounts() doesn\u0027t.\n\nA shrinkable mount can become locked once the owner of a user namespace\nputs it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked\nproperty now moves to the mount at the bottom making it possible to\nunmount the top mount.\n\nSo umount() of an unlocked ancestor now expires the bottom mount first\nand the covered directory is revealed:\n\n  move_mount(c -\u003e x/hidden, MOVE_MOUNT_BENEATH) = 0\n  the cover after the lock moved:  umount2(x/hidden) = 0\n  the holder of the lock:          umount2(x/hidden) = EINVAL\n  the root of the copy, busy:      umount2(x) = EBUSY\n  reads x/hidden/secret: \"covered-by-root\"\n\nSo leave a locked mount alone as it dies together with its parent. A\nplain umount() of an unlocked mount with a locked one below it is EBUSY\nfrom now on. It\u0027s the same for any other locked child. A lazy umount\nstill takes the whole tree.\n\nmark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree()\nleaves a mount on an expiry list alone and nothing else puts a locked\none on such a list. Add an assert for this."
          }
        ],
        "id": "CVE-2026-98978",
        "lastModified": "2026-10-24T14:16:50.377",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 5.8,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-23T13:17:19.517",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6b8dc3713a76346d212abab46cbfc8d7070f534c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d23265a12e4991ce7aedce670c0b6b598cadb644"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}

FKIE_CVE-2026-98978

Vulnerability from fkie_nvd - Published: 2026-10-23 13:17 - Updated: 2026-10-23 13:17

Severity

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6b8dc3713a76346d212abab46cbfc8d7070f534c
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d23265a12e4991ce7aedce670c0b6b598cadb644
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6b8dc3713a76346d212abab46cbfc8d7070f534c",
              "status": "affected",
              "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
              "versionType": "git"
            },
            {
              "lessThan": "d23265a12e4991ce7aedce670c0b6b598cadb644",
              "status": "affected",
              "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
              "versionType": "git"
            },
            {
              "lessThan": "f78ddcc872248c7aa1d7e904928441a0be4c6d5d",
              "status": "affected",
              "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: never expire a locked mount\n\nLocked mounts are special. They protect the underlying files and\ndirectories from being revealed. do_umount() refuses to unmount locked\nmounts but shrink_submounts() doesn\u0027t.\n\nA shrinkable mount can become locked once the owner of a user namespace\nputs it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked\nproperty now moves to the mount at the bottom making it possible to\nunmount the top mount.\n\nSo umount() of an unlocked ancestor now expires the bottom mount first\nand the covered directory is revealed:\n\n  move_mount(c -\u003e x/hidden, MOVE_MOUNT_BENEATH) = 0\n  the cover after the lock moved:  umount2(x/hidden) = 0\n  the holder of the lock:          umount2(x/hidden) = EINVAL\n  the root of the copy, busy:      umount2(x) = EBUSY\n  reads x/hidden/secret: \"covered-by-root\"\n\nSo leave a locked mount alone as it dies together with its parent. A\nplain umount() of an unlocked mount with a locked one below it is EBUSY\nfrom now on. It\u0027s the same for any other locked child. A lazy umount\nstill takes the whole tree.\n\nmark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree()\nleaves a mount on an expiry list alone and nothing else puts a locked\none on such a list. Add an assert for this."
    }
  ],
  "id": "CVE-2026-98978",
  "lastModified": "2026-10-23T13:17:19.517",
  "metrics": {},
  "published": "2026-10-23T13:17:19.517",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6b8dc3713a76346d212abab46cbfc8d7070f534c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d23265a12e4991ce7aedce670c0b6b598cadb644"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-73PW-3QVG-VXHF

Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-23 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

namespace: never expire a locked mount

Locked mounts are special. They protect the underlying files and directories from being revealed. do_umount() refuses to unmount locked mounts but shrink_submounts() doesn't.

A shrinkable mount can become locked once the owner of a user namespace puts it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked property now moves to the mount at the bottom making it possible to unmount the top mount.

So umount() of an unlocked ancestor now expires the bottom mount first and the covered directory is revealed:

move_mount(c -> x/hidden, MOVE_MOUNT_BENEATH) = 0 the cover after the lock moved: umount2(x/hidden) = 0 the holder of the lock: umount2(x/hidden) = EINVAL the root of the copy, busy: umount2(x) = EBUSY reads x/hidden/secret: "covered-by-root"

So leave a locked mount alone as it dies together with its parent. A plain umount() of an unlocked mount with a locked one below it is EBUSY from now on. It's the same for any other locked child. A lazy umount still takes the whole tree.

mark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree() leaves a mount on an expiry list alone and nothing else puts a locked one on such a list. Add an assert for this.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98978"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T13:17:19Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: never expire a locked mount\n\nLocked mounts are special. They protect the underlying files and\ndirectories from being revealed. do_umount() refuses to unmount locked\nmounts but shrink_submounts() doesn\u0027t.\n\nA shrinkable mount can become locked once the owner of a user namespace\nputs it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked\nproperty now moves to the mount at the bottom making it possible to\nunmount the top mount.\n\nSo umount() of an unlocked ancestor now expires the bottom mount first\nand the covered directory is revealed:\n\n  move_mount(c -\u003e x/hidden, MOVE_MOUNT_BENEATH) = 0\n  the cover after the lock moved:  umount2(x/hidden) = 0\n  the holder of the lock:          umount2(x/hidden) = EINVAL\n  the root of the copy, busy:      umount2(x) = EBUSY\n  reads x/hidden/secret: \"covered-by-root\"\n\nSo leave a locked mount alone as it dies together with its parent. A\nplain umount() of an unlocked mount with a locked one below it is EBUSY\nfrom now on. It\u0027s the same for any other locked child. A lazy umount\nstill takes the whole tree.\n\nmark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree()\nleaves a mount on an expiry list alone and nothing else puts a locked\none on such a list. Add an assert for this.",
  "id": "GHSA-73pw-3qvg-vxhf",
  "modified": "2026-10-23T15:31:33Z",
  "published": "2026-10-23T15:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98978"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6b8dc3713a76346d212abab46cbfc8d7070f534c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d23265a12e4991ce7aedce670c0b6b598cadb644"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

MSRC_CVE-2026-98978

Vulnerability from csaf_microsoft - Published: 2026-10-24 01:10 - Updated: 2026-10-24 01:10

Summary

namespace: never expire a locked mount

Scope

1 vulnerability in this advisory, including CVE-2026-98978.

CVE-2026-98978

Under investigation: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-98978 (GCVE-0-2026-98978)

FKIE_CVE-2026-98978

GHSA-73PW-3QVG-VXHF

MSRC_CVE-2026-98978

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour