CVE-2026-98994 statmount: read the parent of an unmounted mount under mount_lock

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mountlock statmountmntbasic reads the ids of the parent through m-mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything abo...

CVE-2026-98994

The Linux kernel contains a vulnerability where the statmount_mnt_basic() function can dereference a mount that has already been freed. This occurs because the function reads m->mnt_parent twice while holding the mount_lock , allowing a concurrent mntput() operation to unmount children and fre...

EUVD-2026-108788

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mountlock statmountmntbasic reads the ids of the parent through m-mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything abo...

CVE-2026-98993 namespace: don't inherit MNT_UMOUNT in clone_mnt()

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNTUMOUNT in clonemnt MNTUMOUNT gets raised on a mount that umounttree or umountone has taken out of its namespace. It's never cleared. detachmounts unhooks a mount that carries it instead of unmounting i...

CVE-2026-98993 namespace: don't inherit MNT_UMOUNT in clone_mnt()

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNTUMOUNT in clonemnt MNTUMOUNT gets raised on a mount that umounttree or umountone has taken out of its namespace. It's never cleared. detachmounts unhooks a mount that carries it instead of unmounting i...

CVE-2026-98993

The Linux kernel contains a vulnerability where clone_mnt() fails to mask the MNT_UMOUNT flag. This occurs because clone_mnt() only masks MNT_INTERNAL_FLAGS, which does not include MNT_UMOUNT. Consequently, a mount that was lazily unmounted but kept alive by a file descriptor (e.g., via nsfs or p...

EUVD-2026-108787

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNTUMOUNT in clonemnt MNTUMOUNT gets raised on a mount that umounttree or umountone has taken out of its namespace. It's never cleared. detachmounts unhooks a mount that carries it instead of unmounting i...

CVE-2026-98992 namespace: don't copy an unmounted mount tree

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

CVE-2026-98992

The Linux kernel contains a vulnerability in may_copy_tree() where it fails to stop walking an unmounted mount tree. Specifically, when dealing with nsfs or pidfs mounts that are lazily unmounted but kept alive by a file descriptor, recursive operations using MS_REC or AT_RECURSIVE continue to co...

CVE-2026-98992 namespace: don't copy an unmounted mount tree

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

EUVD-2026-108786

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

CVE-2026-98991 namespace: queue a mount only once for mount notifications

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

CVE-2026-98991 namespace: queue a mount only once for mount notifications

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

EUVD-2026-108785

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

CVE-2026-98991

A slab-use-after-free vulnerability exists in the Linux kernel due to a flaw in how mount notifications are queued. The mnt_notify_add() function fails to check if a mount is already on the notify_list. Under specific conditions involving propagate_umount(), shrink_submounts(), and mark_mounts_fo...

CVE-2026-98990 namespace: check a submount for references right before unmounting it

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrinksubmounts and markmountsforexpiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided by...

CVE-2026-98990

A vulnerability exists in the Linux kernel where the functions shrink_submounts() and mark_mounts_for_expiry() fail to properly validate submount references before unmounting. Because unmounting the first mount alters the tree structure for subsequent operations, propagate_umount() may incorrectl...

CVE-2026-98990 namespace: check a submount for references right before unmounting it

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrinksubmounts and markmountsforexpiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided by...

EUVD-2026-108784

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrinksubmounts and markmountsforexpiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided by...

CVE-2026-98989 namespace: check a recursive bind mount for mount namespace loops

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...