{"id":"CVE-2026-98983","kind":"vulnerability","aliases":["CVE-2026-98983"],"related":[],"title":"Linux kernel: failed unshare drops namespace references it never took","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nunshare: don't drop active namespace references that were never taken\n\nActive references on the namespaces of an nsproxy are taken when the\nnsproxy is installed into a task in switch_task_namespaces() and\ncopy_namespaces() and dropped again by put_nsproxy() through\ndeactivate_nsproxy().\n\nBut ksys_unshare() calls put_nsproxy() on an nsproxy that was never\ninstalled when set_cred_ucounts() fails. The new namespaces of that\nnsproxy go from zero to minus one and the namespaces shared with the\ncaller lose a reference that belongs to the nsproxy the caller keeps\nusing:\n\n  WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230\n   nsproxy_ns_active_put\n   deactivate_nsproxy\n   ksys_unshare\n\nAfterwards the namespaces the caller lives in aren't listed by listns()\nanymore. set_cred_ucounts() only fails when alloc_ucounts() can't\nallocate and it only allocates when the real uid of the caller differs\nfrom its effective uid.\n\nCommit cefd55bd2159 (\"nsproxy: fix free_nsproxy() and simplify\ncreate_new_namespaces()\") separated the two cases on purpose.\nnsproxy_free() frees an nsproxy that was prepared but never installed\nand that's what a failed setns() uses in put_nsset(). Export it and use\nit for a failed unshare() as well.","summary":"When unshare() fails on a credential allocation error, the kernel drops active references on namespaces that the caller still uses, which triggers a kernel warning and makes those namespaces disappear from listns(). The sources describe a reliability and integrity problem in namespace reference counting, and do not describe code execution or privilege escalation.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","kernel","linux","runtime"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T13:17:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:13+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T04:56:13Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: failed unshare drops namespace references it never took","impact":"low","summary":"When unshare() fails on a credential allocation error, the kernel drops active references on namespaces that the caller still uses, which triggers a kernel warning and makes those namespaces disappear from listns(). The sources describe a reliability and integrity problem in namespace reference counting, and do not describe code execution or privilege escalation.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","containers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Kernel warning and namespace reference count corruption in local callers","analyst_note":"Find the fixed kernel versions and stable backport commits from the kernel.org commit referenced in the NVD entry for CVE-2026-98983.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources describe the Linux kernel's unshare path, where set_cred_ucounts() can fail when the real uid of the caller differs from its effective uid and allocation fails. The sources do not say which kernel versions are affected or which configurations are exposed. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000599,"input_tokens":3721,"output_tokens":453,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':186C '-2026':12A,15A '-98983':13A,16A '171':180C 'activ':32B,88C,95C,184C,190C 'afterward':196C 'alloc':27B,215C,219C,223C 'anymor':208C 'aren':203C 'belong':170C 'call':132C 'caller':38B,165C,175C,200C,230C 'case':250C 'cefd55bd2159':237C 'code':69B 'commit':236C 'contain':17B 'copi':118C 'count':64B 'creat':244C 'cred':144C,210C 'credenti':26B 'cve':11A,14A 'deactiv':127C,192C 'describ':55B,68B 'differ':231C 'disappear':50B 'drop':5A,31B,87C,121C 'effect':234C 'error':28B 'escal':73B 'execut':70B 'export':275C 'fail':3A,23B,146C,213C,269C,282C 'fix':239C 'follow':79C 'free':240C,254C,255C 'go':153C 'instal':109C,141C,263C 'integr':59B 'keep':176C 'kernel':2A,18B,30B,44B,77C 'kernel/nscommon.c':179C 'ksys':130C,194C 'linux':1A,19B,76C 'list':205C 'listn':52B,207C 'live':201C 'lose':166C 'make':47B 'minus':157C 'namespac':6A,35B,49B,62B,89C,99C,116C,119C,149C,161C,198C,246C 'never':9A,93C,140C,262C 'new':148C,245C 'ns':182C,189C 'nsproxi':102C,107C,125C,128C,134C,137C,152C,173C,188C,193C,238C,241C,253C,257C 'nsset':274C 'one':158C 'prepar':260C 'privileg':72B 'problem':60B 'purpos':252C 'put':124C,133C,185C,191C,273C 'real':226C 'ref':183C 'refer':7A,33B,63B,90C,96C,168C 'reliabl':57B 'resolv':83C 'runtim':20B 'separ':247C 'set':143C,209C 'setn':270C 'share':162C 'simplifi':243C 'sourc':54B 'still':39B 'switch':114C 'taken':94C,104C 'task':112C,115C 'took':10A 'trigger':42B 'two':249C 'ucount':145C,211C,216C 'uid':227C,235C 'unshar':4A,22B,84C,131C,195C,283C 'use':40B,177C,271C,278C 'vulner':80C 'warn':45B,178C 'well':285C 'x1cd/0x230':187C 'zero':155C","nicknames":[],"mitigations":[],"who_affected":"The sources describe the Linux kernel's unshare path, where set_cred_ucounts() can fail when the real uid of the caller differs from its effective uid and allocation fails. The sources do not say which kernel versions are affected or which configurations are exposed. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98983","severity":null,"published_at":"2026-10-23T13:17:20+00:00","modified_at":"2026-10-23T13:17:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98983","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98983","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}