CVE-2026-98997

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

CVE-2026-98996 fs: don't silently unmount busy mounts

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

CVE-2026-98996

The Linux kernel contains a vulnerability in the propagate_mount_busy() helper function, which fails to correctly identify busy mounts during synchronous unmounting. Due to a logic mismatch with the propagate_umount() function, the kernel may skip reference checks on mount copies that have two or...

CVE-2026-98996 fs: don't silently unmount busy mounts

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

EUVD-2026-108790

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

CVE-2026-98996

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

CVE-2026-98995 namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

EUVD-2026-108789

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

CVE-2026-98995

The Linux kernel contains a vulnerability in mnt_change_mountpoint() where it fails to reset the ->overmount pointer of an old parent during a mount move, unlike __umount_mnt(). This discrepancy can occur during a reparent() operation where propagate_umount() moves a surviving overmount. If a ...

CVE-2026-98995 namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

CVE-2026-98994 statmount: read the parent of an unmounted mount under mount_lock

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mountlock statmountmntbasic reads the ids of the parent through m-mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything abo...

CVE-2026-98994 statmount: read the parent of an unmounted mount under mount_lock

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mountlock statmountmntbasic reads the ids of the parent through m-mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything abo...

CVE-2026-98994

The Linux kernel contains a vulnerability where the statmount_mnt_basic() function can dereference a mount that has already been freed. This occurs because the function reads m->mnt_parent twice while holding the mount_lock , allowing a concurrent mntput() operation to unmount children and fre...

EUVD-2026-108788

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mountlock statmountmntbasic reads the ids of the parent through m-mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything abo...

CVE-2026-98993 namespace: don't inherit MNT_UMOUNT in clone_mnt()

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNTUMOUNT in clonemnt MNTUMOUNT gets raised on a mount that umounttree or umountone has taken out of its namespace. It's never cleared. detachmounts unhooks a mount that carries it instead of unmounting i...

CVE-2026-98993

The Linux kernel contains a vulnerability where clone_mnt() fails to mask the MNT_UMOUNT flag. This occurs because clone_mnt() only masks MNT_INTERNAL_FLAGS, which does not include MNT_UMOUNT. Consequently, a mount that was lazily unmounted but kept alive by a file descriptor (e.g., via nsfs or p...

CVE-2026-98993 namespace: don't inherit MNT_UMOUNT in clone_mnt()

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNTUMOUNT in clonemnt MNTUMOUNT gets raised on a mount that umounttree or umountone has taken out of its namespace. It's never cleared. detachmounts unhooks a mount that carries it instead of unmounting i...

EUVD-2026-108787

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNTUMOUNT in clonemnt MNTUMOUNT gets raised on a mount that umounttree or umountone has taken out of its namespace. It's never cleared. detachmounts unhooks a mount that carries it instead of unmounting i...

EUVD-2026-108786

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

CVE-2026-98992 namespace: don't copy an unmounted mount tree

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...