Live › vulnerability › CVE-2026-98983
Go to dashboardWhen unshare() fails on a credential allocation error, the kernel drops active references on namespaces that the caller still uses, which triggers a kernel warning and makes those namespaces disappear from listns(). The sources describe a reliability and integrity problem in namespace reference counting, and do not describe code execution or privilege escalation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
The sources describe the Linux kernel's unshare path, where set_cred_ucounts() can fail when the real uid of the caller differs from its effective uid and allocation fails. The sources do not say which kernel versions are affected or which configurations are exposed. unknown
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
unshare: don't drop active namespace references that were never taken
Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy().
But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using:
WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare
Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid.
Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.
This page as .md · .json · in your agent: get_signal("CVE-2026-98983")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.