SB20261023192 - Race condition in Linux kernel fs

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261023192

SB20261023192 - Race condition in Linux kernel fs

Published: October 23, 2026

Security Bulletin ID SB20261023192
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Race condition (CVE-ID: CVE-2026-98981)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose file contents hidden by mounts in another mount namespace.

The vulnerability exists due to a race condition in the Linux kernel mount namespace handling when unlink(), rmdir(), or rename() removes an entry that is a mountpoint in another mount namespace. A local user can race pathname lookups against mount detachment while the underlying directory entry remains hashed and positive to access file contents previously hidden by the mount.


Remediation

Install update from vendor's website.

References