Live › vulnerability › CVE-2026-98991
Go to dashboardThe Linux kernel can queue the same mount twice for fanotify mount notifications, leaving freed mounts on the list. Later mount operations on the host then read freed memory, which the sources describe as a KASAN use-after-free.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running a Linux kernel with the flawed mount notification code, where an attacker can bind-mount a MNT_SHRINKABLE mount (such as NFS, AFS, CIFS or tracefs submounts) inside a mount namespace watched by a FAN_MARK_MNTNS fanotify mark. The sources say root in a user namespace can trigger it, so multi-tenant and container hosts with user namespaces enabled are the main concern. Single-user systems without these mounts or namespaces are less exposed.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel build in your distribution's advisory (unknown in the sources)sysctl kernel.unprivileged_userns_clone or sysctl user.max_user_namespaces (unknown in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
namespace: queue a mount only once for mount notifications
mnt_notify_add() puts a mount on notify_list. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per namespace_sem hold. It isn't.
propagate_umount() moves a surviving overmount off a stack of mounts that are going away and queues it as moved. shrink_submounts() and mark_mounts_for_expiry() call umount_tree() for several mounts under a single namespace_sem hold. So the second umount_tree() can take down exactly the mount the first one reparented, reparent it once more and so end up queueing it a second time.
The second list_add_tail() cuts the mounts queued in between out of the list while the head still points at the last of them. notify_mnt_list() then only visits that one mount and the others are freed after the grace period with notify_list still pointing at them. Every later mount operation on the host walks freed memory:
BUG: KASAN: slab-use-after-free in __list_add_valid_or_report Read of size 8 at addr ffff8881003d57e0 by task notify_dq/162 __list_add_valid_or_report+0x15c/0x1a0 mnt_add_to_ns+0x322/0x890 attach_recursive_mnt.isra.0+0xf2a/0x1a00 path_mount+0x139c/0x1d40
This needs a mount with MNT_SHRINKABLE to bind from. That's what finish_automount() creates (submounts of NFS, AFS and CIFS and the tracefs mount below debugfs). Bind mounts inherit the flag. A mount namespace with a FAN_MARK_MNTNS mark does the rest and root in a user namespace can have both.
Initialize to_notify in alloc_vfsmnt() and leave a mount alone that is queued already. mnt_notify() looks at the state the mount has when the list is drained so a single entry per mount is enough. The move event for a mount that is unmounted under the same hold is lost. That's fine. The detach is what matters.
This page as .md · .json · in your agent: get_signal("CVE-2026-98991")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.