Use-after-free in Linux kernel - CVE-2026-98993

Vulnerability details

The vulnerability allows a local user to cause a denial of service and potentially corrupt kernel memory through a use-after-free.

The vulnerability exists due to improper inheritance of the MNT_UMOUNT flag in clone_mnt() when copying a lazily unmounted mount kept alive by an open file descriptor. A local user can perform bind-mount and namespace operations on the resulting mount to disrupt mount tracking, cause nonterminating mount traversal, or trigger access to a freed mount namespace structure.

The detached source mount can be copied through this path only when its root is an nsfs or pidfs file.

Affected software

How to mitigate CVE-2026-98993

External References

• https://git.kernel.org/stable/c/5077b52e9e4d72da53c50251296b99cd416765a1
• https://git.kernel.org/stable/c/99698cfa34e493fc091219056aae446fe9442a96
• https://git.kernel.org/stable/c/c26c1a91ad2881a194f7af543e0b57f0870006b2
• https://git.kernel.org/stable/c/e2c6d326216642011da318b9edfd5d57ebd5a56f
• https://git.kernel.org/stable/c/eecc9cd0fc07dba3f7fb0b2f844b4029435a2f7b

Related Security Bulletins

• Use-after-free in Linux kernel clone_mnt() and mount namespace lifecycle handling in fs/namespace.c
• Debian update for linux