Incorrect authorization in Linux kernel - CVE-2026-98988

Vulnerability identifier: #VU157523

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98988

CWE-ID: CWE-863

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to bypass mount-based masking and read otherwise hidden files.

The vulnerability exists due to improper access control in create_new_namespace() in the Linux kernel when copying a mount tree using open_tree(OPEN_TREE_NAMESPACE), allowing covering child mounts to be omitted. A local user can create a user namespace, copy a mount tree without privileges over the source mount namespace, and enter the resulting mount namespace to access underlying content that the omitted mounts concealed.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-realtime (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-azure (Ubuntu package)
linux-raspi (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-azure-fde-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-gke (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-aws-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-43.43
linux-realtime (Ubuntu package) - update to 7.0.0-43.43.1
linux-oracle (Ubuntu package) - update to 7.0.0-1016.18
linux-aws (Ubuntu package) - update to 7.0.0-1017.18
linux-gcp (Ubuntu package) - update to 7.0.0-1017.19
linux-azure (Ubuntu package) - update to 7.0.0-1020.21
linux-raspi (Ubuntu package) - update to 7.0.0-1023.23
linux-ibm (Ubuntu package) - update to 7.0.0-1018.18
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1016.18~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1017.19~24.04.1
linux-azure-fde-7.0 (Ubuntu package) - update to 7.0.0-1019.19~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1018.18
linux-gke (Ubuntu package) - update to 7.0.0-1010.11
linux-azure-fde (Ubuntu package) - update to 7.0.0-1019.19
linux-aws-7.0 (Ubuntu package) - update to 7.0.0-1017.18~24.04.1

• https://git.kernel.org/stable/c/0febe278ec45b1ccdbe9bd5ff1ba365d8fd55e2a
• https://git.kernel.org/stable/c/b8a94a405ddcf45e9470789e0a821d8f2aa4ca10

• Incorrect authorization in Linux kernel fs
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws-7.0, linux-azure-fde, linux-azure-fde-7.0 and more
• Ubuntu update for linux-raspi