Live › vulnerability › CVE-2026-99172
Go to dashboardWhen creating an IPC namespace fails partway through setup, the kernel drops the mqueue mount with a plain mntput(), which does not actually release a long-term mount. The mount and its mqueue superblock are leaked, so the failure path wastes kernel memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Linux kernel builds that include the IPC mqueue namespace code and create IPC namespaces, such as container runtimes that use new IPC namespaces. Systems without IPC namespace creation are unaffected. The sources do not name fixed kernel versions.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ipc: drop the mqueue mount with kern_unmount() on setup failure
mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its ->mnt_ns is MNT_NS_INTERNAL. When setting up the mqueue or ipc sysctls or msg_init_ns() fails afterwards, create_ipc_ns() drops it with a plain mntput(). With ->mnt_ns set that takes the fast path of mntput_no_expire(). The count drops to zero and nothing ever kills the mount, so the mount and the mqueue superblock are leaked.
Commit dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace") added the first failure path after mq_init_ns() and never dropped the mount. Commit 7229d74e5e8c ("ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure") tried to fix that with a mntput() but that doesn't help for a long-term mount.
Use kern_unmount(). free_ipc() open-codes the same thing for a namespace that made it.
This page as .md · .json · in your agent: get_signal("CVE-2026-99172")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.