SB20261023181 - Off-by-one in Linux kernel fs

Description

This security bulletin contains information about 1 vulnerability.

1) Off-by-one (CVE-ID: CVE-2026-98987)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt access to mounted content and prevent synchronous unmounting of an affected mount.

The vulnerability exists due to an off-by-one error in attach_recursive_mnt() in the Linux kernel mount namespace implementation when traversing a source mount's overmount chain. A local user can trigger mount propagation with a mount namespace file as the topmost and only such mount in the chain, causing an existing mount in a propagated copy to be attached beneath an unreachable nsfs dentry, hiding its content and preventing synchronous unmounting of its parent.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8714b44adac7b10506e1db3ef1710689751f0f10
• https://git.kernel.org/stable/c/87ecd4c6da146363384a603bd9e90c90e7275536
• https://git.kernel.org/stable/c/b9c40553f6ceba50042281eef6f701e5fb719726