EUVD-2026-108770

In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attachrecursivemnt transfers MNTLOCKED from the top mount to the mount that is moved beneath it with MOVEMOUNTBENEATH. This allows the owner of a user...

EUVD-2026-108772

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

CVE-2026-98978

The Linux kernel contains a vulnerability where a locked mount could be prematurely expired. A shrinkable mount could become locked if a user namespace owner moved it beneath a locked mount using MOVE_MOUNT_BENEATH , causing the locked property to move to the bottom mount. This allowed the top mo...

CVE-2026-98976

The Linux kernel is affected by a vulnerability where the attach_recursive_mnt() function incorrectly transfers the MNT_LOCKED property. Specifically, it transfers the lock from the top mount to the mount moved beneath it during a MOVE_MOUNT_BENEATH operation. This allows a user namespace owner t...