SB20261023173 - Use-after-free in Linux kernel fs

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98995)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause kernel memory corruption that may result in a denial of service.

The vulnerability exists due to use-after-free in the Linux kernel mount namespace code in fs/namespace.c when mnt_change_mountpoint() reparents a mount without clearing the old parent's overmount pointer. A local user can trigger a sequence of mount reparenting and unmounting operations while retaining a file descriptor to the old parent, then use that mount as the target of a mount-beneath operation to make topmost_overmount() follow the dangling pointer and do_lock_mount() take references on freed memory, potentially causing kernel memory corruption and a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/08d575ee89393fd812dbdca7b5d7b4574cd5a564
• https://git.kernel.org/stable/c/476ef286a7a5db8bda51325dc0c45887b4d99d9a
• https://git.kernel.org/stable/c/5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5