{"id":"CVE-2026-98982","kind":"vulnerability","aliases":["CVE-2026-98982"],"related":[],"title":"Linux kernel: bind-mounting a pseudo file can free a dentry under lockless walk","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: don't let a pseudo dentry become the root of a mount\n\nd_alloc_pseudo() hands out dentries for pipes, sockets and other files\nthat are never anyone's child or parent. They carry DCACHE_NORCU and\ndentry_free() frees them right away because no lockless path walk can\never reach them. That holds as long as such a dentry isn't the root of\na mount. But bind mounting /proc/self/fd/<fd> of such a file does\nexactly that.\n\nMost callers of alloc_file_pseudo() put their files on kernel-internal\nmounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It\nplaces the token file on the bpffs mount the caller handed it and that\nmount is in the caller's mount namespace so the clone goes through:\n\n  mount --bind /proc/self/fd/<token> <file>\n  open_tree(tokfd, \"\", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount()\n\n__follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq\nand d_flags of the dentry and only then checks mount_lock. The dentry\ncan be gone by then. The final mntput() of an unmounted parent unhooks\na child that stayed attached to it under mount_lock alone. When the\nchild's holder does the final put right after that the root is dput()\nand freed immediately while a walker that found the mount hashed still\nlooks at it.\n\nRefuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing\nsensible can be done with a bind mount of a bpf token anyway.","summary":"A bpf token file on bpffs can be bind-mounted through /proc/self/fd, making a pseudo dentry the root of a mount. A racing lockless path walk can then use that dentry after it is freed, a use-after-free in the kernel.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","kernel","linux","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- `uname -r` and compare against the fixed kernel in your distribution's advisory: unknown\n- Check whether bpffs is mounted and bpf tokens are used: `mount -t bpf`\n- Check whether unprivileged users can create user namespaces: `sysctl kernel.unprivileged_userns_clone` (unknown on other distributions)","fix":"- Update the Linux kernel to a release that contains the upstream fix for CVE-2026-98982: unknown\n- Reboot into the patched kernel and confirm with `uname -r`","status":"open","published_at":"2026-10-23T13:17:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:16+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:56:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that contains the upstream fix for CVE-2026-98982: unknown\n- Reboot into the patched kernel and confirm with `uname -r`","reach":"local","title":"Linux kernel: bind-mounting a pseudo file can free a dentry under lockless walk","impact":"high","summary":"A bpf token file on bpffs can be bind-mounted through /proc/self/fd, making a pseudo dentry the root of a mount. A racing lockless path walk can then use that dentry after it is freed, a use-after-free in the kernel.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","bpf","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user may corrupt kernel memory, possibly escalating privileges","analyst_note":"Find the fixed kernel versions and distribution advisories for CVE-2026-98982 from the NVD entry and the upstream kernel commit.","how_to_check":"- `uname -r` and compare against the fixed kernel in your distribution's advisory: unknown\n- Check whether bpffs is mounted and bpf tokens are used: `mount -t bpf`\n- Check whether unprivileged users can create user namespaces: `sysctl kernel.unprivileged_userns_clone` (unknown on other distributions)","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Hosts running a Linux kernel with the unpatched namespace code, where a process can create a bpf token on a bpffs mount it can bind-mount. Sources do not say which kernel versions or distributions are fixed, so the exact range is unknown. Systems that do not use bpf tokens or restrict user namespaces are likely less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000706,"input_tokens":3772,"output_tokens":658,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-98982':18A,21A '/proc/self/fd':41B,154C,217C 'alloc':97C,165C 'alon':279C 'anyon':111C 'anyway':337C 'attach':273C 'away':126C 'becom':90C 'bind':4A,38B,152C,216C,331C 'bind-mount':3A,37B 'bpf':22B,30B,182C,335C 'bpffs':34B,194C 'caller':163C,197C,206C 'carri':117C 'check':251C 'child':113C,270C,282C 'clone':212C,226C,313C 'copi':178C 'creat':184C 'cve':16A,19A 'd':96C,240C,243C 'dcach':118C,318C 'dentri':12A,45B,60B,89C,101C,121C,143C,247C,255C,320C 'doesn':185C 'done':328C 'dput':295C 'empti':222C 'ever':133C 'exact':160C 'file':8A,32B,107C,158C,166C,170C,191C 'final':262C,287C 'flag':244C 'follow':78C,229C 'found':303C 'free':10A,69B,122C,123C 'freed':64B,297C 'goe':213C 'gone':258C 'hand':99C,198C 'hash':306C 'hold':137C 'holder':284C 'host':28B 'immedi':298C 'intern':174C 'isn':144C 'kernel':2A,23B,72B,76C,173C 'kernel-intern':172C 'let':86C 'linux':1A,24B,75C 'load':233C 'lock':253C,278C 'lockless':14A,53B,129C 'long':139C 'look':308C 'make':42B 'may':177C 'mnt':234C 'mntput':263C 'mount':5A,39B,50B,95C,150C,153C,175C,195C,202C,208C,215C,228C,230C,238C,252C,277C,305C,315C,332C 'move':227C 'namespac':83C,209C 'never':110C 'norcu':119C,319C 'noth':324C 'open':218C,224C 'parent':115C,267C 'path':54B,130C,223C 'pipe':103C 'place':188C 'pseudo':7A,44B,88C,98C,167C 'put':168C,288C 'race':52B 'rcu':231C 'reach':134C 'read':239C 'refus':180C,311C 'resolv':82C 'right':125C,289C 'root':47B,92C,147C,235C,293C,323C 'runtim':25B 'self':27B 'self-host':26B 'sensibl':325C 'seq':241C 'socket':104C 'stay':272C 'still':307C 'token':31B,183C,190C,336C 'tokfd':220C 'tree':179C,219C,225C 'unhook':268C 'unmount':266C 'use':58B,67B 'use-after-fre':66B 'vulner':79C 'walk':15A,55B,131C 'walker':301C","nicknames":[],"mitigations":[],"who_affected":"Hosts running a Linux kernel with the unpatched namespace code, where a process can create a bpf token on a bpffs mount it can bind-mount. Sources do not say which kernel versions or distributions are fixed, so the exact range is unknown. Systems that do not use bpf tokens or restrict user namespaces are likely less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98982","severity":null,"published_at":"2026-10-23T13:17:20+00:00","modified_at":"2026-10-23T13:17:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98982","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98982","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}