SB20261023182 - Incorrect authorization in Linux kernel fs

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect authorization (CVE-ID: CVE-2026-98988)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass mount-based masking and read otherwise hidden files.

The vulnerability exists due to improper access control in create_new_namespace() in the Linux kernel when copying a mount tree using open_tree(OPEN_TREE_NAMESPACE), allowing covering child mounts to be omitted. A local user can create a user namespace, copy a mount tree without privileges over the source mount namespace, and enter the resulting mount namespace to access underlying content that the omitted mounts concealed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0febe278ec45b1ccdbe9bd5ff1ba365d8fd55e2a
• https://git.kernel.org/stable/c/b8a94a405ddcf45e9470789e0a821d8f2aa4ca10