CVE-2026-98981

The Linux kernel is vulnerable to a race condition where a dentry remains hashed and positive between the detach_mounts() and d_delete() calls during unlink(), rmdir(), or rename() operations. This allows a lookup to find the dentry in the dcache and potentially uncover data hidden by the mounts,...

CVE-2026-98981 namespace: unhash a dentry before detaching the mounts on it

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...

CVE-2026-98981 namespace: unhash a dentry before detaching the mounts on it

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...

CVE-2026-98980 namei: don't reveal overmounted entries in refwalk

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. stepinto stepinto rechecks dseq and followmountrcu rechecks mountlock. An entry that gets unlinked in between causes the...

EUVD-2026-108774

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. stepinto stepinto rechecks dseq and followmountrcu rechecks mountlock. An entry that gets unlinked in between causes the...

CVE-2026-98980 namei: don't reveal overmounted entries in refwalk

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. stepinto stepinto rechecks dseq and followmountrcu rechecks mountlock. An entry that gets unlinked in between causes the...

CVE-2026-98980

The Linux kernel contains a vulnerability where refwalk can reveal overmounted entries in a very narrow window. While rcuwalk validates dentries before acceptance via step_into(), lookup_fast() in refwalk accepts hashed dentries without this recheck. If an entry is unlinked after a reference is t...

EUVD-2026-108773

In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount...

CVE-2026-98979

The Linux kernel contains a vulnerability where automounts can be added even when the parent mount is not in the caller's mount namespace. The issue stems from clone_private_mount() using MNT_NS_INTERNAL, which allows attach_recursive_mnt() to accept a mount point that count_mounts() subsequently...

CVE-2026-98979 namespace: refuse an automount below a mount that is in no namespace

In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount...

CVE-2026-98979 namespace: refuse an automount below a mount that is in no namespace

In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount...

CVE-2026-98978

The Linux kernel is affected by a vulnerability where locked mounts are incorrectly handled during unmounting operations. Specifically, shrink_submounts() fails to respect locked mounts, which allows a shrinkable mount to become locked when placed beneath a locked mount via MOVE_MOUNT_BENEATH. Th...

CVE-2026-98978 namespace: never expire a locked mount

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

CVE-2026-98978 namespace: never expire a locked mount

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

EUVD-2026-108772

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

CVE-2026-98978

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

CVE-2026-98977

The Linux kernel contains a vulnerability where attach_recursive_mnt() incorrectly handles mount locking for automounts when propagated across user namespaces . Because the kernel may use the caller's mount namespace to determine the user namespace, automounts accessed during path lookup can resu...

CVE-2026-98977 namespace: handle mount locking for automounts correctly

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

CVE-2026-98977 namespace: handle mount locking for automounts correctly

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

EUVD-2026-108771

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...