{"id":"CVE-2026-98995","kind":"vulnerability","aliases":["CVE-2026-98995"],"related":[],"title":"Linux kernel: mount reparenting leaves a dangling pointer, enabling use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: reset the old parent's ->overmount in mnt_change_mountpoint()\n\n__umount_mnt() resets ->overmount of the parent when it unmounts the\nmount that overmounts it. mnt_change_mountpoint() doesn't. It moves the\nmount to its new parent and leaves the old one pointing at it.\n\nFor a mount that is moved beneath in attach_recursive_mnt() that doesn't\nmatter. The new mount has already reset ->overmount of the old parent by\nthe time the old top mount is moved onto it.\n\nIt matters for reparent() though. propagate_umount() moves a surviving\novermount onto the first ancestor that isn't going to be unmounted. The\nmount it was taken from is unmounted immediately afterwards. If a file\ndescriptor keeps that unmounted mount alive ->overmount points at the\nmoved mount. That's a dangling pointer and UAF as the moved mount is\nunmounted and freed.\n\ndo_lock_mount() follows ->overmount from the target path under\nmount_lock. With a file descriptor on such a mount as the target of a\nmount beneath topmost_overmount() walks into the freed mount and\ndo_lock_mount() takes references on whatever it finds there.\n\nSo reset ->overmount of the old parent in mnt_change_mountpoint() the\nsame way __umount_mnt() does. A mount's ->overmount is then always a\nmount that is attached to it.","summary":"In the Linux kernel's mount namespace code, moving a mount to a new parent leaves the old parent pointing at a mount that is later freed, so a later mount operation can follow the stale pointer. A local user who can trigger this could corrupt kernel memory, which may lead to privilege escalation.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","linux-kernel","runtime","self-hosted"],"not_affected_if":["non-linux-systems"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T13:17:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:02+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:56:02Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: mount reparenting leaves a dangling pointer, enabling use-after-free","impact":"high","summary":"In the Linux kernel's mount namespace code, moving a mount to a new parent leaves the old parent pointing at a mount that is later freed, so a later mount operation can follow the stale pointer. A local user who can trigger this could corrupt kernel memory, which may lead to privilege escalation.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted","containers"],"confidence":0.5,"needs_auth":"yes","worst_case":"local code can corrupt kernel memory and possibly escalate privileges","analyst_note":"Find the upstream kernel commit and affected/fixed kernel version ranges and any NVD CVSS score for CVE-2026-98995 at https://nvd.nist.gov/vuln/detail/CVE-2026-98995.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["non-linux-systems"],"who_is_affected":"Systems running a Linux kernel version that predates the upstream fix for this mount namespace bug. Only the kernel's mount handling is involved, so the exposure is about local users and processes that can manipulate mounts and file descriptors. Exact affected kernel versions are not stated in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000625,"input_tokens":3696,"output_tokens":510,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98995':16A,19A 'afterward':207C 'aliv':216C 'alreadi':158C 'alway':306C 'ancestor':190C 'attach':147C,311C 'beneath':145C,264C 'chang':101C,119C,292C 'code':35B 'contain':20B 'corrupt':73B 'could':72B 'cve':14A,17A 'dangl':7A,226C 'descriptor':211C,253C 'doesn':121C,151C 'enabl':9A 'escal':81B 'file':210C,252C 'find':281C 'first':189C 'follow':61B,87C,241C 'free':13A 'freed':54B,237C,270C 'go':194C 'host':27B 'immedi':206C 'isn':192C 'keep':212C 'kernel':2A,23B,31B,74B,85C 'later':53B,57B 'lead':78B 'leav':5A,43B,132C 'linux':1A,22B,30B,84C 'linux-kernel':21B 'local':66B 'lock':239C,249C,274C 'matter':153C,177C 'may':77B 'memori':75B 'mnt':100C,104C,118C,149C,291C,298C 'mount':3A,33B,38B,50B,58B,114C,126C,141C,156C,171C,199C,215C,222C,233C,240C,248C,257C,263C,271C,275C,301C,308C 'mountpoint':102C,120C,293C 'move':36B,124C,144C,173C,183C,221C,232C 'namespac':34B,92C 'new':41B,129C,155C 'old':45B,95C,134C,163C,169C,288C 'one':135C 'onto':174C,187C 'oper':59B 'overmount':98C,106C,116C,160C,186C,217C,242C,266C,285C,303C 'parent':42B,46B,96C,109C,130C,164C,289C 'path':246C 'point':47B,136C,218C 'pointer':8A,64B,227C 'privileg':80B 'propag':181C 'recurs':148C 'refer':277C 'repar':4A,179C 'reset':93C,105C,159C,284C 'resolv':91C 'runtim':24B 'self':26B 'self-host':25B 'stale':63B 'surviv':185C 'take':276C 'taken':202C 'target':245C,260C 'though':180C 'time':167C 'top':170C 'topmost':265C 'trigger':70B 'uaf':229C 'umount':103C,182C,297C 'unmount':112C,197C,205C,214C,235C 'use':11A 'use-after-fre':10A 'user':67B 'vulner':88C 'walk':267C 'way':296C 'whatev':279C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel version that predates the upstream fix for this mount namespace bug. Only the kernel's mount handling is involved, so the exposure is about local users and processes that can manipulate mounts and file descriptors. Exact affected kernel versions are not stated in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98995","severity":null,"published_at":"2026-10-23T13:17:21+00:00","modified_at":"2026-10-23T13:17:21+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98995","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98995","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}