Race condition in Linux kernel - CVE-2026-98981

Vulnerability details

The vulnerability allows a local user to disclose file contents hidden by mounts in another mount namespace.

The vulnerability exists due to a race condition in the Linux kernel mount namespace handling when unlink(), rmdir(), or rename() removes an entry that is a mountpoint in another mount namespace. A local user can race pathname lookups against mount detachment while the underlying directory entry remains hashed and positive to access file contents previously hidden by the mount.

Affected software

How to mitigate CVE-2026-98981

External References

• https://git.kernel.org/stable/c/528b383dc35d1e5caf64ddf5d35f983ae543b0d0
• https://git.kernel.org/stable/c/8300de4aa5d09061bfcf2af5b52c0cdba3873185
• https://git.kernel.org/stable/c/8d71bfc9b3fc15d7103e82ea9dc5057541866e46
• https://git.kernel.org/stable/c/d29cd99db3db74cf3447be74d25740981789d461
• https://git.kernel.org/stable/c/db90eecbde319527aa9480c039d32a0f5fe80574

Related Security Bulletins

• Race condition in Linux kernel fs
• Debian update for linux