Incorrect authorization in Linux kernel - CVE-2026-98977

Vulnerability details

The vulnerability allows a local user to clear security flags on propagated automounts in their own namespace and prevent the host from changing flags on its own automounts.

The vulnerability exists due to incorrect authorization in the Linux kernel's attach_recursive_mnt() function in fs/namespace.c when assigning mount locks during automount propagation across user namespaces. A local user can trigger an automount through a directory descriptor referring to a host mount from a child namespace to cause the host's automount to be locked instead of the child's copy, allowing changes to mount security flags in the child namespace while blocking corresponding host operations.

Affected software

How to mitigate CVE-2026-98977

External References

• https://git.kernel.org/stable/c/33aadc7c72055fca93cb5a3691d836ebf8b31c9b
• https://git.kernel.org/stable/c/5e8f3ac8fa3d411b422ad32b9168c46a4824cc79
• https://git.kernel.org/stable/c/6ab37fae14196ba2262b152a7d9222c50356d278
• https://git.kernel.org/stable/c/b3ccde78f1608836e62320428abc0e8aa9cf2329
• https://git.kernel.org/stable/c/e01c79761c7b3373e80094c5eadb21cb864fa8bc

Related Security Bulletins

• Incorrect authorization in Linux kernel fs
• Debian update for linux