SB20261023170 - Improper input validation in Linux kernel fs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261023170

SB20261023170 - Improper input validation in Linux kernel fs

Published: October 23, 2026

Security Bulletin ID SB20261023170
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper input validation (CVE-ID: CVE-2026-98992)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to recursively copy an unmounted mount tree, including overmounts that remain attached to it.

The vulnerability exists due to improper validation of mount state in the Linux kernel mount namespace handling code when processing recursive bind-mount requests involving nsfs or pidfs files. A local user can retain a file descriptor to a lazily unmounted bind mount and request a recursive bind mount through that descriptor to copy the unmounted root and its attached overmounts.


Remediation

Install update from vendor's website.

References