---
id: "CVE-2026-98982"
kind: "vulnerability"
aliases: ["CVE-2026-98982"]
title: "Linux kernel: bind-mounting a pseudo file can free a dentry under lockless walk"
severity: "unknown"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["bpf", "kernel", "linux", "runtime", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-23T13:17:20+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98982", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98982", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: bind-mounting a pseudo file can free a dentry under lockless walk

A bpf token file on bpffs can be bind-mounted through /proc/self/fd, making a pseudo dentry the root of a mount. A racing lockless path walk can then use that dentry after it is freed, a use-after-free in the kernel.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel in your distribution's advisory: unknown
- Check whether bpffs is mounted and bpf tokens are used: `mount -t bpf`
- Check whether unprivileged users can create user namespaces: `sysctl kernel.unprivileged_userns_clone` (unknown on other distributions)

## Fix

- Update the Linux kernel to a release that contains the upstream fix for CVE-2026-98982: unknown
- Reboot into the patched kernel and confirm with `uname -r`

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98982
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98982

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

namespace: don't let a pseudo dentry become the root of a mount

d_alloc_pseudo() hands out dentries for pipes, sockets and other files
that are never anyone's child or parent. They carry DCACHE_NORCU and
dentry_free() frees them right away because no lockless path walk can
ever reach them. That holds as long as such a dentry isn't the root of
a mount. But bind mounting /proc/self/fd/<fd> of such a file does
exactly that.

Most callers of alloc_file_pseudo() put their files on kernel-internal
mounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It
places the token file on the bpffs mount the caller handed it and that
mount is in the caller's mount namespace so the clone goes through:

  mount --bind /proc/self/fd/<token> <file>
  open_tree(tokfd, "", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount()

__follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq
and d_flags of the dentry and only then checks mount_lock. The dentry
can be gone by then. The final mntput() of an unmounted parent unhooks
a child that stayed attached to it under mount_lock alone. When the
child's holder does the final put right after that the root is dput()
and freed immediately while a walker that found the mount hashed still
looks at it.

Refuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing
sensible can be done with a bind mount of a bpf token anyway.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_