SB20261023184 - Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel fs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261023184

SB20261023184 - Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel fs

Published: October 23, 2026

Security Bulletin ID SB20261023184
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-98990)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to cause a denial of service by unmounting mounts that are still in use, disrupting filesystem access.

The vulnerability exists due to a time-of-check time-of-use error in the Linux kernel mount namespace handling in fs/namespace.c when processing successive unmounts during submount shrinking or mount expiry. A local privileged user can trigger unmount operations in a suitable mount tree to make an earlier unmount relocate a busy mount into a later unmount's propagation path, where it is removed without rechecking its reference count, disrupting access to the active mount.

Exploitation requires a mount with MNT_SHRINKABLE, such as an automounted NFS, AFS, or CIFS submount or the tracefs mount below debugfs. Bind mounts inherit this flag.


Remediation

Install update from vendor's website.

References