CVE-2026-43472

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43472", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.011Z", "datePublished": "2026-05-08T14:22:31.556Z", "dateUpdated": "2026-11-06T15:42:56.209Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:25:16.258Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nunshare: fix unshare_fs() handling\n\nThere's an unpleasant corner case in unshare(2), when we have a\nCLONE_NEWNS in flags and current->fs hadn't been shared at all; in that\ncase copy_mnt_ns() gets passed current->fs instead of a private copy,\nwhich causes interesting warts in proof of correctness]\n\n> I guess if private means fs->users == 1, the condition could still be true.\n\nUnfortunately, it's worse than just a convoluted proof of correctness.\nConsider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS\n(and current->fs->users == 1).\n\nWe pass current->fs to copy_mnt_ns(), all right. Suppose it succeeds and\nflips current->fs->{pwd,root} to corresponding locations in the new namespace.\nNow we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM).\nWe call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's\ndestroyed and its mount tree is dissolved, but... current->fs->root and\ncurrent->fs->pwd are both left pointing to now detached mounts.\n\nThey are pinning those, so it's not a UAF, but it leaves the calling\nprocess with unshare(2) failing with -ENOMEM _and_ leaving it with\npwd and root on detached isolated mounts. The last part is clearly a bug.\n\nThere is other fun related to that mess (races with pivot_root(), including\nthe one between pivot_root() and fork(), of all things), but this one\nis easy to isolate and fix - treat CLONE_NEWNS as \"allocate a new\nfs_struct even if it hadn't been shared in the first place\". Sure, we could\ngo for something like \"if both CLONE_NEWNS *and* one of the things that might\nend up failing after copy_mnt_ns() call in create_new_namespaces() are set,\nforce allocation of new fs_struct\", but let's keep it simple - the cost\nof copy_fs_struct() is trivial.\n\nAnother benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets\na freshly allocated fs_struct, yet to be attached to anything. That\nseriously simplifies the analysis...\n\nFWIW, that bug had been there since the introduction of unshare(2) ;-/"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/fork.c"], "versions": [{"version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "845bf3c6963a52096d0d3866e4a92db77a0c03d8", "status": "affected", "versionType": "git"}, {"version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "d3ffc8f13034af895531a02c30b1fe3a34b46432", "status": "affected", "versionType": "git"}, {"version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "d0d99f60538ddb4a62ccaac2168d8f448965f083", "status": "affected", "versionType": "git"}, {"version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "d7963d6997fea86a6def242ac36198b86655f912", "status": "affected", "versionType": "git"}, {"version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "aa9ebc084505fb26dd90f4d7a249045aad152043", "status": "affected", "versionType": "git"}, {"version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "af8f4be3b68ac8caa41c8e5ead0eeaf5e85e42d0", "status": "affected", "versionType": "git"}, {"version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "42e21e74061b0ebbd859839f81acf10efad02a27", "status": "affected", "versionType": "git"}, {"version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "6c4b2243cb6c0755159bd567130d5e12e7b10d9f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/fork.c"], "versions": [{"version": "2.6.16", "status": "affected"}, {"version": "0", "lessThan": "2.6.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.12.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.18.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.19.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/845bf3c6963a52096d0d3866e4a92db77a0c03d8"}, {"url": "https://git.kernel.org/stable/c/d3ffc8f13034af895531a02c30b1fe3a34b46432"}, {"url": "https://git.kernel.org/stable/c/d0d99f60538ddb4a62ccaac2168d8f448965f083"}, {"url": "https://git.kernel.org/stable/c/d7963d6997fea86a6def242ac36198b86655f912"}, {"url": "https://git.kernel.org/stable/c/aa9ebc084505fb26dd90f4d7a249045aad152043"}, {"url": "https://git.kernel.org/stable/c/af8f4be3b68ac8caa41c8e5ead0eeaf5e85e42d0"}, {"url": "https://git.kernel.org/stable/c/42e21e74061b0ebbd859839f81acf10efad02a27"}, {"url": "https://git.kernel.org/stable/c/6c4b2243cb6c0755159bd567130d5e12e7b10d9f"}], "title": "unshare: fix unshare_fs() handling", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43472", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:39:35.857143Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:42:56.209Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43472", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:39:35.857143Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:39:36.945Z"}}], "cna": {"title": "unshare: fix unshare_fs() handling", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "845bf3c6963a52096d0d3866e4a92db77a0c03d8", "versionType": "git"}, {"status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "d3ffc8f13034af895531a02c30b1fe3a34b46432", "versionType": "git"}, {"status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "d0d99f60538ddb4a62ccaac2168d8f448965f083", "versionType": "git"}, {"status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "d7963d6997fea86a6def242ac36198b86655f912", "versionType": "git"}, {"status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "aa9ebc084505fb26dd90f4d7a249045aad152043", "versionType": "git"}, {"status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "af8f4be3b68ac8caa41c8e5ead0eeaf5e85e42d0", "versionType": "git"}, {"status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "42e21e74061b0ebbd859839f81acf10efad02a27", "versionType": "git"}, {"status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "lessThan": "6c4b2243cb6c0755159bd567130d5e12e7b10d9f", "versionType": "git"}], "programFiles": ["kernel/fork.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.16"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.253", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.203", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.167", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.130", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.19", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.9", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/fork.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/845bf3c6963a52096d0d3866e4a92db77a0c03d8"}, {"url": "https://git.kernel.org/stable/c/d3ffc8f13034af895531a02c30b1fe3a34b46432"}, {"url": "https://git.kernel.org/stable/c/d0d99f60538ddb4a62ccaac2168d8f448965f083"}, {"url": "https://git.kernel.org/stable/c/d7963d6997fea86a6def242ac36198b86655f912"}, {"url": "https://git.kernel.org/stable/c/aa9ebc084505fb26dd90f4d7a249045aad152043"}, {"url": "https://git.kernel.org/stable/c/af8f4be3b68ac8caa41c8e5ead0eeaf5e85e42d0"}, {"url": "https://git.kernel.org/stable/c/42e21e74061b0ebbd859839f81acf10efad02a27"}, {"url": "https://git.kernel.org/stable/c/6c4b2243cb6c0755159bd567130d5e12e7b10d9f"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nunshare: fix unshare_fs() handling\n\nThere's an unpleasant corner case in unshare(2), when we have a\nCLONE_NEWNS in flags and current->fs hadn't been shared at all; in that\ncase copy_mnt_ns() gets passed current->fs instead of a private copy,\nwhich causes interesting warts in proof of correctness]\n\n> I guess if private means fs->users == 1, the condition could still be true.\n\nUnfortunately, it's worse than just a convoluted proof of correctness.\nConsider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS\n(and current->fs->users == 1).\n\nWe pass current->fs to copy_mnt_ns(), all right. Suppose it succeeds and\nflips current->fs->{pwd,root} to corresponding locations in the new namespace.\nNow we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM).\nWe call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's\ndestroyed and its mount tree is dissolved, but... current->fs->root and\ncurrent->fs->pwd are both left pointing to now detached mounts.\n\nThey are pinning those, so it's not a UAF, but it leaves the calling\nprocess with unshare(2) failing with -ENOMEM _and_ leaving it with\npwd and root on detached isolated mounts. The last part is clearly a bug.\n\nThere is other fun related to that mess (races with pivot_root(), including\nthe one between pivot_root() and fork(), of all things), but this one\nis easy to isolate and fix - treat CLONE_NEWNS as \"allocate a new\nfs_struct even if it hadn't been shared in the first place\". Sure, we could\ngo for something like \"if both CLONE_NEWNS *and* one of the things that might\nend up failing after copy_mnt_ns() call in create_new_namespaces() are set,\nforce allocation of new fs_struct\", but let's keep it simple - the cost\nof copy_fs_struct() is trivial.\n\nAnother benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets\na freshly allocated fs_struct, yet to be attached to anything. That\nseriously simplifies the analysis...\n\nFWIW, that bug had been there since the introduction of unshare(2) ;-/"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.253", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.203", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.167", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.130", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.78", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.19", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.9", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "2.6.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:25:16.258Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43472", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:42:56.209Z", "dateReserved": "2026-05-01T14:12:56.011Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-08T14:22:31.556Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/fork.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "845bf3c6963a52096d0d3866e4a92db77a0c03d8", "status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "versionType": "git"}, {"lessThan": "d3ffc8f13034af895531a02c30b1fe3a34b46432", "status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "versionType": "git"}, {"lessThan": "d0d99f60538ddb4a62ccaac2168d8f448965f083", "status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "versionType": "git"}, {"lessThan": "d7963d6997fea86a6def242ac36198b86655f912", "status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "versionType": "git"}, {"lessThan": "aa9ebc084505fb26dd90f4d7a249045aad152043", "status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "versionType": "git"}, {"lessThan": "af8f4be3b68ac8caa41c8e5ead0eeaf5e85e42d0", "status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "versionType": "git"}, {"lessThan": "42e21e74061b0ebbd859839f81acf10efad02a27", "status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "versionType": "git"}, {"lessThan": "6c4b2243cb6c0755159bd567130d5e12e7b10d9f", "status": "affected", "version": "741a295130606143edbf9fc740f633dbc1e6225f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/fork.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.16"}, {"lessThan": "2.6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.253", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.203", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.167", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.78", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.19", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C527DFD3-87E2-45E8-8722-B18DC25946EE", "versionEndExcluding": "5.10.253", "versionStartIncluding": "2.6.16.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "20DDB3E9-AABF-4107-ADB0-5362AA067045", "versionEndExcluding": "5.15.203", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EDC6BAF-B710-4E26-B6AA-D68922EE7B43", "versionEndExcluding": "6.1.167", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C57BB918-DF28-46B3-94F7-144176841267", "versionEndExcluding": "6.6.130", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "28D591F5-B196-4CC9-905C-DC80F116E7A8", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D394AC60-6F28-435F-872A-CCDF384B8331", "versionEndExcluding": "6.18.19", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E825E7C3-FEAC-4FD3-8A81-78D7387948C9", "versionEndExcluding": "6.19.9", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:-:*:*:*:*:*:*", "matchCriteriaId": "EBF2513D-8F4F-4ED5-ADCE-9933F34F1BFB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "54393D69-B368-4296-9798-D81570495C6C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "6791A801-9E06-47DD-912F-D8594E2F6B3F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc5:*:*:*:*:*:*", "matchCriteriaId": "AE90CCED-3A5B-46E3-A6B0-4865AB786289", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc6:*:*:*:*:*:*", "matchCriteriaId": "CBFF6DE7-6D7C-469A-9B2D-2F6E915F55B0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.16:rc7:*:*:*:*:*:*", "matchCriteriaId": "D0CD4E4B-E756-4401-A352-871EBA5B8680", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nunshare: fix unshare_fs() handling\n\nThere's an unpleasant corner case in unshare(2), when we have a\nCLONE_NEWNS in flags and current->fs hadn't been shared at all; in that\ncase copy_mnt_ns() gets passed current->fs instead of a private copy,\nwhich causes interesting warts in proof of correctness]\n\n> I guess if private means fs->users == 1, the condition could still be true.\n\nUnfortunately, it's worse than just a convoluted proof of correctness.\nConsider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS\n(and current->fs->users == 1).\n\nWe pass current->fs to copy_mnt_ns(), all right. Suppose it succeeds and\nflips current->fs->{pwd,root} to corresponding locations in the new namespace.\nNow we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM).\nWe call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's\ndestroyed and its mount tree is dissolved, but... current->fs->root and\ncurrent->fs->pwd are both left pointing to now detached mounts.\n\nThey are pinning those, so it's not a UAF, but it leaves the calling\nprocess with unshare(2) failing with -ENOMEM _and_ leaving it with\npwd and root on detached isolated mounts. The last part is clearly a bug.\n\nThere is other fun related to that mess (races with pivot_root(), including\nthe one between pivot_root() and fork(), of all things), but this one\nis easy to isolate and fix - treat CLONE_NEWNS as \"allocate a new\nfs_struct even if it hadn't been shared in the first place\". Sure, we could\ngo for something like \"if both CLONE_NEWNS *and* one of the things that might\nend up failing after copy_mnt_ns() call in create_new_namespaces() are set,\nforce allocation of new fs_struct\", but let's keep it simple - the cost\nof copy_fs_struct() is trivial.\n\nAnother benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets\na freshly allocated fs_struct, yet to be attached to anything. That\nseriously simplifies the analysis...\n\nFWIW, that bug had been there since the introduction of unshare(2) ;-/"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nunshare: correcci\u00f3n del manejo de unshare_fs()\n\nExiste un caso l\u00edmite desagradable en unshare(2), cuando tenemos un CLONE_NEWNS en flags y current -> fs no hab\u00eda sido compartido en absoluto; en ese caso, a copy_mnt_ns() se le pasa current -> fs en lugar de una copia privada, lo que causa imperfecciones interesantes en la prueba de correcci\u00f3n]\n\n> Supongo que si \u2019privado\u2019 significa fs -> users == 1, la condici\u00f3n a\u00fan podr\u00eda ser verdadera.\n\nDesafortunadamente, es peor que solo una prueba de correcci\u00f3n enrevesada. Considere el caso en que tenemos CLONE_NEWCGROUP adem\u00e1s de CLONE_NEWNS (y current -> fs -> users == 1).\n\nPasamos current -> fs a copy_mnt_ns(), de acuerdo. Supongamos que tiene \u00e9xito y cambia current -> fs -> {pwd,root} a las ubicaciones correspondientes en el nuevo espacio de nombres. Ahora procedemos a copy_cgroup_ns(), que falla (p. ej., con -ENOMEM). Llamamos a put_mnt_ns() en el espacio de nombres creado por copy_mnt_ns(), este es destruido y su \u00e1rbol de montajes se disuelve, pero... current -> fs -> root y current -> fs -> pwd quedan ambos apuntando a montajes ahora desvinculados.\n\nEst\u00e1n anclando esos, por lo que no es un UAF, pero deja al proceso llamador con unshare(2) fallando con -ENOMEM _y_ dej\u00e1ndolo con pwd y root en montajes aislados desvinculados. La \u00faltima parte es claramente un error.\n\nHay otras cosas divertidas relacionadas con ese l\u00edo (condiciones de carrera con pivot_root(), incluyendo la que se da entre pivot_root() y fork(), de todas las cosas), pero esta es f\u00e1cil de aislar y corregir: tratar CLONE_NEWNS como \u2019asignar una nueva fs_struct incluso si no se hab\u00eda compartido en primer lugar\u2019. Claro, podr\u00edamos optar por algo como \u2019si tanto CLONE_NEWNS como una de las cosas que podr\u00edan terminar fallando despu\u00e9s de la llamada a copy_mnt_ns() en create_new_namespaces() est\u00e1n configuradas, forzar la asignaci\u00f3n de una nueva fs_struct\u2019, pero manteng\u00e1moslo simple: el costo de copy_fs_struct() es trivial.\n\nOtro beneficio es que copy_mnt_ns() con CLONE_NEWNS siempre obtiene una fs_struct reci\u00e9n asignada, a\u00fan por adjuntar a algo. Eso simplifica seriamente el an\u00e1lisis...\n\nPara que conste, ese error hab\u00eda estado ah\u00ed desde la introducci\u00f3n de unshare(2) ;-/"}], "id": "CVE-2026-43472", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43472", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:39:35.857143Z", "version": "2.0.3"}}]}, "published": "2026-05-08T15:17:00.313", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/42e21e74061b0ebbd859839f81acf10efad02a27"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6c4b2243cb6c0755159bd567130d5e12e7b10d9f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/845bf3c6963a52096d0d3866e4a92db77a0c03d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/aa9ebc084505fb26dd90f4d7a249045aad152043"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/af8f4be3b68ac8caa41c8e5ead0eeaf5e85e42d0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d0d99f60538ddb4a62ccaac2168d8f448965f083"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d3ffc8f13034af895531a02c30b1fe3a34b46432"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d7963d6997fea86a6def242ac36198b86655f912"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: unshare: fix unshare_fs() handling", "id": "2468206", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468206"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's `unshare` system call. A local user, when attempting to create new namespaces with specific flags, could encounter a scenario where the process's current working directory and root directory pointers become detached. This occurs if the cgroup namespace creation fails after the mount namespace is successfully copied. The affected process is left in an unusable state, leading to a denial of service."], "name": "CVE-2026-43472", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43472\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43472\nhttps://lore.kernel.org/linux-cve-announce/2026050805-CVE-2026-43472-2394@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,845bf3c6963a52096d0d3866e4a92db77a0c03d8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d3ffc8f13034af895531a02c30b1fe3a34b46432)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d0d99f60538ddb4a62ccaac2168d8f448965f083)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d7963d6997fea86a6def242ac36198b86655f912)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,aa9ebc084505fb26dd90f4d7a249045aad152043)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,af8f4be3b68ac8caa41c8e5ead0eeaf5e85e42d0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,42e21e74061b0ebbd859839f81acf10efad02a27)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6c4b2243cb6c0755159bd567130d5e12e7b10d9f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.78,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.19,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T20:45:16.044565+00:00", "updated": "2026-05-21T16:15:14.345301+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}