CVE-2026-98991 namespace: queue a mount only once for mount notifications

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

EUVD-2026-108785

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

CVE-2026-98991

A slab-use-after-free vulnerability exists in the Linux kernel due to a flaw in how mount notifications are queued. The mnt_notify_add() function fails to check if a mount is already on the notify_list. Under specific conditions involving propagate_umount(), shrink_submounts(), and mark_mounts_fo...

CVE-2026-98990 namespace: check a submount for references right before unmounting it

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrinksubmounts and markmountsforexpiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided by...

CVE-2026-98990

A vulnerability exists in the Linux kernel where the functions shrink_submounts() and mark_mounts_for_expiry() fail to properly validate submount references before unmounting. Because unmounting the first mount alters the tree structure for subsequent operations, propagate_umount() may incorrectl...

CVE-2026-98990 namespace: check a submount for references right before unmounting it

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrinksubmounts and markmountsforexpiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided by...

EUVD-2026-108784

In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it shrinksubmounts and markmountsforexpiry first collect all the mounts they are allowed to unmount and then unmount them. Whether a mount is busy is decided by...

CVE-2026-98989 namespace: check a recursive bind mount for mount namespace loops

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

EUVD-2026-108783

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98989 namespace: check a recursive bind mount for mount namespace loops

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98989

The Linux kernel contains a vulnerability where the do_loopback() function fails to properly check for recursive bind mount loops when using the MS_REC flag. Specifically, while it checks the starting dentry, it allows the copying of mount namespace files from other namespaces. This allows an att...

EUVD-2026-108782

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPENTREENAMESPACE opentreeOPENTREENAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

CVE-2026-98988 namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPENTREENAMESPACE opentreeOPENTREENAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

CVE-2026-98988

The Linux kernel contains a vulnerability in how open_tree(OPEN_TREE_NAMESPACE) handles mount namespaces. When an unprivileged user creates a new user namespace and calls open_tree, the copy of the mount tree incorrectly preserves covered mounts (e.g., mounts used to mask /proc or /sys). This all...

CVE-2026-98988 namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE

In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPENTREENAMESPACE opentreeOPENTREENAMESPACE creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace...

EUVD-2026-108781

In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attachrecursivemnt preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on top o...

CVE-2026-98987 namespace: look at the topmost mount for a mount namespace file

In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attachrecursivemnt preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on top o...

CVE-2026-98987 namespace: look at the topmost mount for a mount namespace file

In the Linux kernel, the following vulnerability has been resolved: namespace: look at the topmost mount for a mount namespace file attachrecursivemnt preallocates a mountpoint for the root of the topmost mount of the source so that a mount that already sits at the destination can be put on top o...

CVE-2026-98987

The Linux kernel contains a vulnerability where the attach_recursive_mnt() function fails to inspect the topmost mount of a source chain for a mount namespace file. This oversight causes mnt_change_mountpoint() to incorrectly attach existing mounts below the root of the mount namespace file as a ...

EUVD-2026-108780

In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mntnsrelease drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotifymntnsdelete. That takes the mutex of every...