CVE-2026-98978 namespace: never expire a locked mount

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

CVE-2026-98978

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

CVE-2026-98977

The Linux kernel contains a vulnerability where attach_recursive_mnt() incorrectly handles mount locking for automounts when propagated across user namespaces . Because the kernel may use the caller's mount namespace to determine the user namespace, automounts accessed during path lookup can resu...

CVE-2026-98977 namespace: handle mount locking for automounts correctly

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

CVE-2026-98977 namespace: handle mount locking for automounts correctly

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

EUVD-2026-108771

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

CVE-2026-98976

The Linux kernel contains a vulnerability where attach_recursive_mnt() incorrectly transfers the MNT_LOCKED property from a top mount to a mount moved beneath it using MOVE_MOUNT_BENEATH. This flaw allows a user namespace owner to replace a locked /proc or its root by exploiting how propagated co...

EUVD-2026-108770

In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attachrecursivemnt transfers MNTLOCKED from the top mount to the mount that is moved beneath it with MOVEMOUNTBENEATH. This allows the owner of a user...

CVE-2026-98976 namespace: keep the lock on a mount that a propagated copy is moved beneath

In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attachrecursivemnt transfers MNTLOCKED from the top mount to the mount that is moved beneath it with MOVEMOUNTBENEATH. This allows the owner of a user...

CVE-2026-98976 namespace: keep the lock on a mount that a propagated copy is moved beneath

In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attachrecursivemnt transfers MNTLOCKED from the top mount to the mount that is moved beneath it with MOVEMOUNTBENEATH. This allows the owner of a user...

CVE-2026-98975 xfs: stop exchanging reflink flags when exchanging mappings

In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes every mapping moved and hands the reflink flag over to the other file...

CVE-2026-98975 xfs: stop exchanging reflink flags when exchanging mappings

In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes every mapping moved and hands the reflink flag over to the other file...

EUVD-2026-108769

In the Linux kernel, the following vulnerability has been resolved: xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes every mapping moved and hands the reflink flag over to the other file...

CVE-2026-98975

The Linux kernel contains a vulnerability in the XFS filesystem where the xmi_can_exchange_reflink_flags() function incorrectly assumes all mappings are moved during an exchange from offset 0 to i_disk_size. This incorrect assumption leads to the clearing of a reflink flag on files that still own...

CVE-2026-98974 xfs: fix exchange-range-to-eof file size exchange

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFSIOCEXCHANGERANGE's TOEOF flag. The bug tricks exchange-range into modifying a file so that it has...

CVE-2026-98974

The Linux kernel contains a vulnerability in the XFS filesystem involving the XFS_IOC_EXCHANGE_RANGE operation's TO_EOF flag. The root cause is that the code incorrectly swaps ondisk and incore file sizes when a nonzero offset is used, leading to incorrect file size reporting. This discrepancy ca...

CVE-2026-98974 xfs: fix exchange-range-to-eof file size exchange

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFSIOCEXCHANGERANGE's TOEOF flag. The bug tricks exchange-range into modifying a file so that it has...

EUVD-2026-108768

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFSIOCEXCHANGERANGE's TOEOF flag. The bug tricks exchange-range into modifying a file so that it has...

CVE-2026-98973

The Linux kernel contains a vulnerability in the drm/bridge component where the drm_bridge_add() function performs an unlocked list_del when re-adding a previously removed bridge. Specifically, the function drops the bridge from bridge_lingering_list without acquiring the bridge_lock . Because br...

CVE-2026-98973 drm/bridge: Fix unlocked list_del in drm_bridge_add()

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked listdel in drmbridgeadd When re-adding a bridge that was previously removed, drmbridgeadd drops it from bridgelingeringlist without holding bridgelock. Both bridgelist and bridgelingeringlist are protecte...