CVE-2026-98980

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98980", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.383Z", "datePublished": "2026-10-23T12:19:53.838Z", "dateUpdated": "2026-10-24T14:09:48.534Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:48.534Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamei: don't reveal overmounted entries in refwalk\n\nIn rcuwalk the dentry is validated before it is accepted. step_into()\nstep_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_lock.\nAn entry that gets unlinked in between causes the lookup to retry and\nmiss.\n\nA refwalk doesn't do this. lookup_fast() takes a reference on the hashed\ndentry and simply accepts it. So an unlink that happens after the\nreference was taken isn't seen by refwalk. That's fine for a simple\nfile. We just happened to open it before it was unlinked, no problem.\n\nFor a mountpoint and specifically a locked mountpoint it very much\nisn't. The unlink detaches all mounts and then removes the name. Any\nrefwalk that hasn't traversed the mounts yet simply reveals the\nunderlying entry. It's a very narrow window but it can be hit:\n\n reads of a covered file in 60 s, 3 walkers, ~15000 unlinks\n no widening 27\n that step + 200 us 3741\n\nSee the appended patch for a more reliable reproducer.\n\nSo check the entry after step_into(). unlink(), rmdir() and rename()\nmark the dentry with dont_mount() before they detach the mounts and\nremove the dentry.\n\nSo a dentry that is marked with DCACHE_CANT_MOUNT and is unhashed by the\ntime its mounts were looked at is a name that was unlinked under the\nrefwalk. DCACHE_CANT_MOUNT is read after the mounts were looked up and\nit is set before they are detached by detach_mounts(). A refwalk that\nmissed the mounts will see DCACHE_CANT_MOUNT.\n\nPlain d_unlinked() is fine. A rename takes the dentry off its hash chain\nbut ___d_drop() leaves d_hash.pprev set. So only __d_drop() and a rename\nover the dentry unhash it. The only move that flips IS_ROOT splices in a\ndisconnected alias. That doesn't have DCACHE_CANT_MOUNT set.\n\nAdd the to step_into_slowpath(). \"..\" and LOOKUP_DOWN may legitimately\nland on an unhashed directory. A refwalk that crossed onto a mount has\npath.mnt different from nd->path.mnt. A dentry that a filesystem dropped\non its own (d_invalidate(), d_drop()) doesn't have the flag set and is\ntreated as before.\n\n // SPDX-License-Identifier: GPL-2.0\n /*\n * unlink_covered: unlink a file that is a mountpoint in a detached copy of\n * its mount, against walkers that open it through that copy.\n *\n * A is a tmpfs with the file f1 (content SECRET_F) and the plain file\n * MARK_A. A' is an open_tree(OPEN_TREE_CLONE) copy of A with MARK_A bound\n * on A'/f1, held through an O_PATH fd on its root once the tree fd is\n * closed. Walkers open f1 through that fd while the driver unlinks A/f1,\n * where nothing is mounted on it. A walker may read MARK_A or get ENOENT.\n * A read of SECRET_F is a hit: the name was found after its mount was\n * gone. The lockless walks use openat2(RESOLVE_CACHED).\n *\n * usage: unlink_covered [-t seconds] [-w walkers]\n */\n #ifndef _GNU_SOURCE\n #define _GNU_SOURCE\n #endif\n #include <errno.h>\n #include <fcntl.h>\n #include <pthread.h>\n #include <stdatomic.h>\n #include <stdio.h>\n #include <stdlib.h>\n #include <string.h>\n #include <unistd.h>\n #include <sys/mount.h>\n #include <sys/stat.h>\n #include <sys/syscall.h>\n #include <linux/openat2.h>\n\n #ifndef __NR_open_tree\n #define __NR_open_tree 428\n #endif\n #ifndef __NR_move_mount\n #define __NR_move_mount 429\n #endif\n #ifndef __NR_openat2\n #define __NR_openat2 437\n #endif\n #ifndef OPEN_TREE_CLONE\n #define OPEN_TREE_CLONE 1\n #endif\n #ifndef OPEN_TREE_CLOEXEC\n #define OPEN_TREE_CLOEXEC O_CLOEXEC\n #endif\n #ifndef MOVE_MOUNT_F_EMPTY_PATH\n #define MOVE_MOUNT_F_EMPTY_PATH 0x00000004\n #endif\n\n #define WORK \"/tmp/uc\"\n #define ADIR WORK \"/A\"\n\n static int duration = 60, nwalkers = 3;\n static atomic_int stop, writer_waiting;\n static pthread_rwlock_t cur_lock = PTHREAD_RWLOCK_INITIALIZER;\n static int cur_fd = -1;\t\t/* the root of A', -1 while there is none */\n static atomic_long n_unlink, n_walk, n_mark, n_enoent, n_othe\n---truncated---"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Local openat/openat2 reaches do_file_open()->path_openat()->lookup_fast()->step_into_slowpath(), the function patched here, while concurrent unlinkat/rmdir/renameat2 reaches detach_mounts(). No network protocol carries the trigger.\nAC:L - Attacker threads control both sides: one retains the dentry in lookup_fast() while another calls dont_mount()/detach_mounts() through unlink or rename. The reproducer repeatedly creates this race and obtained disclosures without artificial widening.\nPR:L - may_delete_dentry() requires only MAY_WRITE|MAY_EXEC on the parent, and opening uses ordinary inode permissions. Required mount setup is also available to an ordinary user through a user namespace because tmpfs has FS_USERNS_MOUNT and may_mount() checks the mount namespace's user_ns.\nUI:N - The attacker performs the mount setup, concurrent unlink or rename, and openat/openat2 attempts through their own processes; no victim must mount, open, or approve anything.\nS:C - lock_mnt_tree() applies MNT_LOCKED specifically to stop an unprivileged child user/mount namespace from revealing objects beneath inherited mounts. Accepting the underlying dentry in step_into_slowpath() crosses that mount-namespace sandbox boundary.\nC:H - After lookup_fast() retains the covered dentry and handle_mounts() misses the detached cover, vulnerable step_into_slowpath() accepts the underlying inode. The reproducer reads the complete SECRET_F contents instead of mounted MARK_A, permitting full disclosure of a covered sensitive file.\nI:H - The same exposed inode reaches do_open()->may_open(); O_WRONLY/O_RDWR permits writes when underlying DAC allows them, and O_TRUNC invokes handle_truncate(). This bypasses a locked or read-only covering mount and allows complete modification of a protected writable file.\nA:H - Opening the wrongly uncovered inode with O_TRUNC reaches handle_truncate() and can empty a covered executable, configuration, database, or other availability-critical file that the locked mount was protecting, causing complete loss of the dependent service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/namei.c"], "versions": [{"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe", "lessThan": "e2b10181d913b4efa3a8dc67a532f859aa5f95e0", "status": "affected", "versionType": "git"}, {"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe", "lessThan": "5f97df8ca7fadf5b53954f50073445ba193902c0", "status": "affected", "versionType": "git"}, {"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe", "lessThan": "b43ff2deef48260bfbdc0dcb520f7929bd3e4007", "status": "affected", "versionType": "git"}, {"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe", "lessThan": "8189ab688f5a2c745dc90b63374da02f213d6994", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/namei.c"], "versions": [{"version": "3.18", "status": "affected"}, {"version": "0", "lessThan": "3.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e2b10181d913b4efa3a8dc67a532f859aa5f95e0"}, {"url": "https://git.kernel.org/stable/c/5f97df8ca7fadf5b53954f50073445ba193902c0"}, {"url": "https://git.kernel.org/stable/c/b43ff2deef48260bfbdc0dcb520f7929bd3e4007"}, {"url": "https://git.kernel.org/stable/c/8189ab688f5a2c745dc90b63374da02f213d6994"}], "title": "namei: don't reveal overmounted entries in refwalk", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/namei.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e2b10181d913b4efa3a8dc67a532f859aa5f95e0", "status": "affected", "version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe", "versionType": "git"}, {"lessThan": "5f97df8ca7fadf5b53954f50073445ba193902c0", "status": "affected", "version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe", "versionType": "git"}, {"lessThan": "b43ff2deef48260bfbdc0dcb520f7929bd3e4007", "status": "affected", "version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe", "versionType": "git"}, {"lessThan": "8189ab688f5a2c745dc90b63374da02f213d6994", "status": "affected", "version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/namei.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.18"}, {"lessThan": "3.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamei: don't reveal overmounted entries in refwalk\n\nIn rcuwalk the dentry is validated before it is accepted. step_into()\nstep_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_lock.\nAn entry that gets unlinked in between causes the lookup to retry and\nmiss.\n\nA refwalk doesn't do this. lookup_fast() takes a reference on the hashed\ndentry and simply accepts it. So an unlink that happens after the\nreference was taken isn't seen by refwalk. That's fine for a simple\nfile. We just happened to open it before it was unlinked, no problem.\n\nFor a mountpoint and specifically a locked mountpoint it very much\nisn't. The unlink detaches all mounts and then removes the name. Any\nrefwalk that hasn't traversed the mounts yet simply reveals the\nunderlying entry. It's a very narrow window but it can be hit:\n\n reads of a covered file in 60 s, 3 walkers, ~15000 unlinks\n no widening 27\n that step + 200 us 3741\n\nSee the appended patch for a more reliable reproducer.\n\nSo check the entry after step_into(). unlink(), rmdir() and rename()\nmark the dentry with dont_mount() before they detach the mounts and\nremove the dentry.\n\nSo a dentry that is marked with DCACHE_CANT_MOUNT and is unhashed by the\ntime its mounts were looked at is a name that was unlinked under the\nrefwalk. DCACHE_CANT_MOUNT is read after the mounts were looked up and\nit is set before they are detached by detach_mounts(). A refwalk that\nmissed the mounts will see DCACHE_CANT_MOUNT.\n\nPlain d_unlinked() is fine. A rename takes the dentry off its hash chain\nbut ___d_drop() leaves d_hash.pprev set. So only __d_drop() and a rename\nover the dentry unhash it. The only move that flips IS_ROOT splices in a\ndisconnected alias. That doesn't have DCACHE_CANT_MOUNT set.\n\nAdd the to step_into_slowpath(). \"..\" and LOOKUP_DOWN may legitimately\nland on an unhashed directory. A refwalk that crossed onto a mount has\npath.mnt different from nd->path.mnt. A dentry that a filesystem dropped\non its own (d_invalidate(), d_drop()) doesn't have the flag set and is\ntreated as before.\n\n // SPDX-License-Identifier: GPL-2.0\n /*\n * unlink_covered: unlink a file that is a mountpoint in a detached copy of\n * its mount, against walkers that open it through that copy.\n *\n * A is a tmpfs with the file f1 (content SECRET_F) and the plain file\n * MARK_A. A' is an open_tree(OPEN_TREE_CLONE) copy of A with MARK_A bound\n * on A'/f1, held through an O_PATH fd on its root once the tree fd is\n * closed. Walkers open f1 through that fd while the driver unlinks A/f1,\n * where nothing is mounted on it. A walker may read MARK_A or get ENOENT.\n * A read of SECRET_F is a hit: the name was found after its mount was\n * gone. The lockless walks use openat2(RESOLVE_CACHED).\n *\n * usage: unlink_covered [-t seconds] [-w walkers]\n */\n #ifndef _GNU_SOURCE\n #define _GNU_SOURCE\n #endif\n #include <errno.h>\n #include <fcntl.h>\n #include <pthread.h>\n #include <stdatomic.h>\n #include <stdio.h>\n #include <stdlib.h>\n #include <string.h>\n #include <unistd.h>\n #include <sys/mount.h>\n #include <sys/stat.h>\n #include <sys/syscall.h>\n #include <linux/openat2.h>\n\n #ifndef __NR_open_tree\n #define __NR_open_tree 428\n #endif\n #ifndef __NR_move_mount\n #define __NR_move_mount 429\n #endif\n #ifndef __NR_openat2\n #define __NR_openat2 437\n #endif\n #ifndef OPEN_TREE_CLONE\n #define OPEN_TREE_CLONE 1\n #endif\n #ifndef OPEN_TREE_CLOEXEC\n #define OPEN_TREE_CLOEXEC O_CLOEXEC\n #endif\n #ifndef MOVE_MOUNT_F_EMPTY_PATH\n #define MOVE_MOUNT_F_EMPTY_PATH 0x00000004\n #endif\n\n #define WORK \"/tmp/uc\"\n #define ADIR WORK \"/A\"\n\n static int duration = 60, nwalkers = 3;\n static atomic_int stop, writer_waiting;\n static pthread_rwlock_t cur_lock = PTHREAD_RWLOCK_INITIALIZER;\n static int cur_fd = -1;\t\t/* the root of A', -1 while there is none */\n static atomic_long n_unlink, n_walk, n_mark, n_enoent, n_othe\n---truncated---"}], "id": "CVE-2026-98980", "lastModified": "2026-10-24T14:16:50.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-23T13:17:19.750", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5f97df8ca7fadf5b53954f50073445ba193902c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8189ab688f5a2c745dc90b63374da02f213d6994"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b43ff2deef48260bfbdc0dcb520f7929bd3e4007"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2b10181d913b4efa3a8dc67a532f859aa5f95e0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: namei: don't reveal overmounted entries in refwalk", "id": "2559721", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559721"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnamei: don't reveal overmounted entries in refwalk\nIn rcuwalk the dentry is validated before it is accepted. step_into()\nstep_into() rechecks d_seq and __follow_mount_rcu() rechecks mount_lock.\nAn entry that gets unlinked in between causes the lookup to retry and\nmiss.\nA refwalk doesn't do this. lookup_fast() takes a reference on the hashed\ndentry and simply accepts it. So an unlink that happens after the\nreference was taken isn't seen by refwalk. That's fine for a simple\nfile. We just happened to open it before it was unlinked, no problem.\nFor a mountpoint and specifically a locked mountpoint it very much\nisn't. The unlink detaches all mounts and then removes the name. Any\nrefwalk that hasn't traversed the mounts yet simply reveals the\nunderlying entry. It's a very narrow window but it can be hit:\nreads of a covered file in 60 s, 3 walkers, ~15000 unlinks\nno widening 27\nthat step + 200 us 3741\nSee the appended patch for a more reliable reproducer.\nSo check the entry after step_into(). unlink(), rmdir() and rename()\nmark the dentry with dont_mount() before they detach the mounts and\nremove the dentry.\nSo a dentry that is marked with DCACHE_CANT_MOUNT and is unhashed by the\ntime its mounts were looked at is a name that was unlinked under the\nrefwalk. DCACHE_CANT_MOUNT is read after the mounts were looked up and\nit is set before they are detached by detach_mounts(). A refwalk that\nmissed the mounts will see DCACHE_CANT_MOUNT.\nPlain d_unlinked() is fine. A rename takes the dentry off its hash chain\nbut ___d_drop() leaves d_hash.pprev set. So only __d_drop() and a rename\nover the dentry unhash it. The only move that flips IS_ROOT splices in a\ndisconnected alias. That doesn't have DCACHE_CANT_MOUNT set.\nAdd the to step_into_slowpath(). \"..\" and LOOKUP_DOWN may legitimately\nland on an unhashed directory. A refwalk that crossed onto a mount has\npath.mnt different from nd->path.mnt. A dentry that a filesystem dropped\non its own (d_invalidate(), d_drop()) doesn't have the flag set and is\ntreated as before.\n// SPDX-License-Identifier: GPL-2.0\n/*\n* unlink_covered: unlink a file that is a mountpoint in a detached copy of\n* its mount, against walkers that open it through that copy.\n*\n* A is a tmpfs with the file f1 (content SECRET_F) and the plain file\n* MARK_A. A' is an open_tree(OPEN_TREE_CLONE) copy of A with MARK_A bound\n* on A'/f1, held through an O_PATH fd on its root once the tree fd is\n* closed. Walkers open f1 through that fd while the driver unlinks A/f1,\n* where nothing is mounted on it. A walker may read MARK_A or get ENOENT.\n* A read of SECRET_F is a hit: the name was found after its mount was\n* gone. The lockless walks use openat2(RESOLVE_CACHED).\n*\n* usage: unlink_covered [-t seconds] [-w walkers]\n*/\n#ifndef _GNU_SOURCE\n#define _GNU_SOURCE\n#endif\n#include <errno.h>\n#include <fcntl.h>\n#include <pthread.h>\n#include <stdatomic.h>\n#include <stdio.h>\n#include <stdlib.h>\n#include <string.h>\n#include <unistd.h>\n#include <sys/mount.h>\n#include <sys/stat.h>\n#include <sys/syscall.h>\n#include <linux/openat2.h>\n#ifndef __NR_open_tree\n#define __NR_open_tree 428\n#endif\n#ifndef __NR_move_mount\n#define __NR_move_mount 429\n#endif\n#ifndef __NR_openat2\n#define __NR_openat2 437\n#endif\n#ifndef OPEN_TREE_CLONE\n#define OPEN_TREE_CLONE 1\n#endif\n#ifndef OPEN_TREE_CLOEXEC\n#define OPEN_TREE_CLOEXEC O_CLOEXEC\n#endif\n#ifndef MOVE_MOUNT_F_EMPTY_PATH\n#define MOVE_MOUNT_F_EMPTY_PATH 0x00000004\n#endif\n#define WORK \"/tmp/uc\"\n#define ADIR WORK \"/A\"\nstatic int duration = 60, nwalkers = 3;\nstatic atomic_int stop, writer_waiting;\nstatic pthread_rwlock_t cur_lock = PTHREAD_RWLOCK_INITIALIZER;\nstatic int cur_fd = -1;/* the root of A', -1 while there is none */\nstatic atomic_long n_unlink, n_walk, n_mark, n_enoent, n_othe\n---truncated---", "A flaw was found in the Linux kernel. A race condition during reference-based path lookup allows a local user to access files hidden beneath mount points, resulting in information disclosure. When an overmounted file or directory is unlinked or removed while another process traverses the path, the kernel fails to properly validate the mount state before returning the underlying directory entry. A local attacker can exploit this timing window to read sensitive data that should be obscured by mounted filesystems."], "name": "CVE-2026-98980", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98980\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98980\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98980.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe,e2b10181d913b4efa3a8dc67a532f859aa5f95e0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe,5f97df8ca7fadf5b53954f50073445ba193902c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe,b43ff2deef48260bfbdc0dcb520f7929bd3e4007)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe,8189ab688f5a2c745dc90b63374da02f213d6994)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.113,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe,e2b10181d913b4efa3a8dc67a532f859aa5f95e0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe,5f97df8ca7fadf5b53954f50073445ba193902c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe,b43ff2deef48260bfbdc0dcb520f7929bd3e4007)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe,8189ab688f5a2c745dc90b63374da02f213d6994)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.113,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.57,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.11,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T17:30:17.171145+00:00", "updated": "2026-10-29T22:45:03.519133+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}