CVE-2026-98982 namespace: don't let a pseudo dentry become the root of a mount

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount dallocpseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree frees them right aw...

EUVD-2026-108776

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount dallocpseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree frees them right aw...

CVE-2026-98982 namespace: don't let a pseudo dentry become the root of a mount

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount dallocpseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree frees them right aw...

CVE-2026-98981 namespace: unhash a dentry before detaching the mounts on it

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...

CVE-2026-98981

The Linux kernel is vulnerable to a race condition where a dentry remains hashed and positive between the detach_mounts() and d_delete() calls during unlink(), rmdir(), or rename() operations. This allows a lookup to find the dentry in the dcache and potentially uncover data hidden by the mounts,...

CVE-2026-98981 namespace: unhash a dentry before detaching the mounts on it

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...

EUVD-2026-108775

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...

EUVD-2026-108774

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. stepinto stepinto rechecks dseq and followmountrcu rechecks mountlock. An entry that gets unlinked in between causes the...

CVE-2026-98980 namei: don't reveal overmounted entries in refwalk

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. stepinto stepinto rechecks dseq and followmountrcu rechecks mountlock. An entry that gets unlinked in between causes the...

CVE-2026-98980 namei: don't reveal overmounted entries in refwalk

In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is validated before it is accepted. stepinto stepinto rechecks dseq and followmountrcu rechecks mountlock. An entry that gets unlinked in between causes the...

CVE-2026-98980

The Linux kernel contains a vulnerability where refwalk can reveal overmounted entries in a very narrow window. While rcuwalk validates dentries before acceptance via step_into(), lookup_fast() in refwalk accepts hashed dentries without this recheck. If an entry is unlinked after a reference is t...

CVE-2026-98979

The Linux kernel contains a vulnerability where automounts can be added even when the parent mount is not in the caller's mount namespace. The issue stems from clone_private_mount() using MNT_NS_INTERNAL, which allows attach_recursive_mnt() to accept a mount point that count_mounts() subsequently...

EUVD-2026-108773

In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount...

CVE-2026-98979 namespace: refuse an automount below a mount that is in no namespace

In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's possible to add autmounts even when the parent mount isn't in the mount namespace of the caller. The only requirement we have is that the parent mount...

CVE-2026-98978

The Linux kernel is affected by a vulnerability where locked mounts are incorrectly handled during unmounting operations. Specifically, shrink_submounts() fails to respect locked mounts, which allows a shrinkable mount to become locked when placed beneath a locked mount via MOVE_MOUNT_BENEATH. Th...

EUVD-2026-108772

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

CVE-2026-98978 namespace: never expire a locked mount

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

CVE-2026-98978

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

CVE-2026-98978 namespace: never expire a locked mount

In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. doumount refuses to unmount locked mounts but shrinksubmounts doesn't. A shrinkable mount ca...

CVE-2026-98977 namespace: handle mount locking for automounts correctly

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...