Vulnerability-Lookup

GHSA-2FR8-4RP8-WVJ2

Vulnerability from github – Published: 2026-10-23 15:31 – Updated: 2026-10-23 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

statmount: read the parent of an unmounted mount under mount_lock

statmount_mnt_basic() reads the ids of the parent through m->mnt_parent with namespace_sem held for reading. That's fine for a mount that is in a namespace. Everything above it is pinned by that namespace.

STATMOUNT_BY_FD also accepts a file descriptor on a mount that has been unmounted on purpose and that only the file descriptor keeps alive. If that mount stayed attached to its parent when it was unmounted the parent is unmounted as well and nothing pins it for the child.

The final mntput() unmounts the children under mount_lock alone and frees the parent afterwards. Concurrently, statmount_mnt_basic() reads m->mnt_parent twice while that can happen and can easily dereference a mount that's already gone.

Read the parent of an unmounted mount under mount_lock. The parent can't be put while it is held and both ids come from the same mount. A mounted mount's parent is pinned by the namespace and a mount can't leave its namespace while namespace_sem is held, so the common case takes no global lock.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98994"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-23T13:17:21Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nstatmount: read the parent of an unmounted mount under mount_lock\n\nstatmount_mnt_basic() reads the ids of the parent through m-\u003emnt_parent\nwith namespace_sem held for reading. That\u0027s fine for a mount that is\nin a namespace. Everything above it is pinned by that namespace.\n\nSTATMOUNT_BY_FD also accepts a file descriptor on a mount that has\nbeen unmounted on purpose and that only the file descriptor keeps alive.\nIf that mount stayed attached to its parent when it was unmounted the\nparent is unmounted as well and nothing pins it for the child.\n\nThe final mntput() unmounts the children under mount_lock alone and\nfrees the parent afterwards. Concurrently, statmount_mnt_basic() reads\nm-\u003emnt_parent twice while that can happen and can easily dereference a\nmount that\u0027s already gone.\n\nRead the parent of an unmounted mount under mount_lock. The parent\ncan\u0027t be put while it is held and both ids come from the same mount. A\nmounted mount\u0027s parent is pinned by the namespace and a mount can\u0027t\nleave its namespace while namespace_sem is held, so the common case\ntakes no global lock.",
  "id": "GHSA-2fr8-4rp8-wvj2",
  "modified": "2026-10-23T15:31:34Z",
  "published": "2026-10-23T15:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98994"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/98fc6c7b6ca676157d2c780bd0a537b2c10fe08f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bb46094057520304073130920c223451c2a694a7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-98994 (GCVE-0-2026-98994)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:20 – Updated: 2026-10-23 12:20

Title

statmount: read the parent of an unmounted mount under mount_lock

Summary

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mount_lock statmount_mnt_basic() reads the ids of the parent through m->mnt_parent with namespace_sem held for reading. That's fine for a mount that is in a namespace. Everything above it is pinned by that namespace. STATMOUNT_BY_FD also accepts a file descriptor on a mount that has been unmounted on purpose and that only the file descriptor keeps alive. If that mount stayed attached to its parent when it was unmounted the parent is unmounted as well and nothing pins it for the child. The final mntput() unmounts the children under mount_lock alone and frees the parent afterwards. Concurrently, statmount_mnt_basic() reads m->mnt_parent twice while that can happen and can easily dereference a mount that's already gone. Read the parent of an unmounted mount under mount_lock. The parent can't be put while it is held and both ids come from the same mount. A mounted mount's parent is pinned by the namespace and a mount can't leave its namespace while namespace_sem is held, so the common case takes no global lock.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 7056 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/98fc6c7b6ca676157…
https://git.kernel.org/stable/c/bb460940575203040…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0e5032237ee5530147fbdf33134297e1490d5ec3 , < 98fc6c7b6ca676157d2c780bd0a537b2c10fe08f (git) Affected: 0e5032237ee5530147fbdf33134297e1490d5ec3 , < bb46094057520304073130920c223451c2a694a7 (git)
Linux	Linux	Affected: 7.0 Unaffected: 0 , < 7.0 (semver) Unaffected: 7.2.11 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "98fc6c7b6ca676157d2c780bd0a537b2c10fe08f",
              "status": "affected",
              "version": "0e5032237ee5530147fbdf33134297e1490d5ec3",
              "versionType": "git"
            },
            {
              "lessThan": "bb46094057520304073130920c223451c2a694a7",
              "status": "affected",
              "version": "0e5032237ee5530147fbdf33134297e1490d5ec3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstatmount: read the parent of an unmounted mount under mount_lock\n\nstatmount_mnt_basic() reads the ids of the parent through m-\u003emnt_parent\nwith namespace_sem held for reading. That\u0027s fine for a mount that is\nin a namespace. Everything above it is pinned by that namespace.\n\nSTATMOUNT_BY_FD also accepts a file descriptor on a mount that has\nbeen unmounted on purpose and that only the file descriptor keeps alive.\nIf that mount stayed attached to its parent when it was unmounted the\nparent is unmounted as well and nothing pins it for the child.\n\nThe final mntput() unmounts the children under mount_lock alone and\nfrees the parent afterwards. Concurrently, statmount_mnt_basic() reads\nm-\u003emnt_parent twice while that can happen and can easily dereference a\nmount that\u0027s already gone.\n\nRead the parent of an unmounted mount under mount_lock. The parent\ncan\u0027t be put while it is held and both ids come from the same mount. A\nmounted mount\u0027s parent is pinned by the namespace and a mount can\u0027t\nleave its namespace while namespace_sem is held, so the common case\ntakes no global lock."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:20:13.244Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/98fc6c7b6ca676157d2c780bd0a537b2c10fe08f"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb46094057520304073130920c223451c2a694a7"
        }
      ],
      "title": "statmount: read the parent of an unmounted mount under mount_lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98994",
    "datePublished": "2026-10-23T12:20:13.244Z",
    "dateReserved": "2026-09-25T10:25:14.384Z",
    "dateUpdated": "2026-10-23T12:20:13.244Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted