CVE-2026-98992

The Linux kernel contains a vulnerability in may_copy_tree() where it fails to stop walking an unmounted mount tree. Specifically, when dealing with nsfs or pidfs mounts that are lazily unmounted but kept alive by a file descriptor, recursive operations using MS_REC or AT_RECURSIVE continue to co...

EUVD-2026-108786

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree maycopytree accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no...

CVE-2026-98989

The Linux kernel contains a vulnerability where the do_loopback() function fails to properly check for recursive bind mount loops when using the MS_REC flag. Specifically, while it checks the starting dentry, it allows the copying of mount namespace files from other namespaces. This allows an att...

EUVD-2026-108783

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...