CVE-2026-98989

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98989", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.384Z", "datePublished": "2026-10-23T12:20:08.366Z", "dateUpdated": "2026-11-10T18:15:21.865Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:21.865Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: check a recursive bind mount for mount namespace loops\n\ndo_loopback() refuses to bind mount the file of a mount namespace that\nis as old as the caller's or older because a mount namespace that holds\na mount of its own file, or of an ancestor's, would cause a cycle. But\nit only checks the dentry the bind mount starts from. With MS_REC\neverything below it is copied and do_loopback() passes\nCL_COPY_MNT_NS_FILE so mount namespace files below the source are\ncopied.\n\nThat's fine for a source in the caller's own mount namespace. Every\nmount namespace file in there passed the same check when it was\nbind-mounted. It isn't fine for a source in another mount namespace.\nmay_copy_tree() accepts a bind mount of any nsfs or pidfs file no matter\nwhat mount namespace it lives in so that /proc/<pid>/ns/<ns> and pidfds\ncan be bind mounted. If we create a bind-mount stack of mount namespaces\nfile descriptors the kernel will copy them irrespective of their\nancestoral relationship to the mount namespace in question:\n\n 151 146 0:7 net:[4026531833] /tmp/nrc/y rw - nsfs nsfs rw\n 152 151 0:7 mnt:[4026532293] /tmp/nrc/y rw - nsfs nsfs rw\n\nMount 152 is a mount of the mount namespace file of mount namespace\n4026532293 inside mount namespace 4026532293. That namespace and every\nmount in it are leaked... All it takes is a process in an older mount\nnamespace that stacks the file and repeating it leaks without limit:\n\n after control: Shmem: 380 kB\n child: mount(/proc/self/fd/6, MS_BIND|MS_REC): ok\n after cycle: Shmem: 65916 kB\n\ndo_move_mount() runs check_for_nsfs_mounts() over a detached tree for\nexactly that reason. Do the same for the copy before it is grafted."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/namespace.c"], "versions": [{"version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac", "lessThan": "b82f3c1131456537a514595c3991b62652507c9d", "status": "affected", "versionType": "git"}, {"version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac", "lessThan": "a0ba48256f5dff6f75a45f8ce39fe57f21df1022", "status": "affected", "versionType": "git"}, {"version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac", "lessThan": "37a82f400efa4d263542a5fa41755b21057f1e5d", "status": "affected", "versionType": "git"}, {"version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac", "lessThan": "c640a01a78e42302879006ed7b7d5a9a943ba815", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/namespace.c"], "versions": [{"version": "3.19", "status": "affected"}, {"version": "0", "lessThan": "3.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b82f3c1131456537a514595c3991b62652507c9d"}, {"url": "https://git.kernel.org/stable/c/a0ba48256f5dff6f75a45f8ce39fe57f21df1022"}, {"url": "https://git.kernel.org/stable/c/37a82f400efa4d263542a5fa41755b21057f1e5d"}, {"url": "https://git.kernel.org/stable/c/c640a01a78e42302879006ed7b7d5a9a943ba815"}], "title": "namespace: check a recursive bind mount for mount namespace loops", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/namespace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b82f3c1131456537a514595c3991b62652507c9d", "status": "affected", "version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac", "versionType": "git"}, {"lessThan": "a0ba48256f5dff6f75a45f8ce39fe57f21df1022", "status": "affected", "version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac", "versionType": "git"}, {"lessThan": "37a82f400efa4d263542a5fa41755b21057f1e5d", "status": "affected", "version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac", "versionType": "git"}, {"lessThan": "c640a01a78e42302879006ed7b7d5a9a943ba815", "status": "affected", "version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/namespace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.19"}, {"lessThan": "3.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: check a recursive bind mount for mount namespace loops\n\ndo_loopback() refuses to bind mount the file of a mount namespace that\nis as old as the caller's or older because a mount namespace that holds\na mount of its own file, or of an ancestor's, would cause a cycle. But\nit only checks the dentry the bind mount starts from. With MS_REC\neverything below it is copied and do_loopback() passes\nCL_COPY_MNT_NS_FILE so mount namespace files below the source are\ncopied.\n\nThat's fine for a source in the caller's own mount namespace. Every\nmount namespace file in there passed the same check when it was\nbind-mounted. It isn't fine for a source in another mount namespace.\nmay_copy_tree() accepts a bind mount of any nsfs or pidfs file no matter\nwhat mount namespace it lives in so that /proc/<pid>/ns/<ns> and pidfds\ncan be bind mounted. If we create a bind-mount stack of mount namespaces\nfile descriptors the kernel will copy them irrespective of their\nancestoral relationship to the mount namespace in question:\n\n 151 146 0:7 net:[4026531833] /tmp/nrc/y rw - nsfs nsfs rw\n 152 151 0:7 mnt:[4026532293] /tmp/nrc/y rw - nsfs nsfs rw\n\nMount 152 is a mount of the mount namespace file of mount namespace\n4026532293 inside mount namespace 4026532293. That namespace and every\nmount in it are leaked... All it takes is a process in an older mount\nnamespace that stacks the file and repeating it leaks without limit:\n\n after control: Shmem: 380 kB\n child: mount(/proc/self/fd/6, MS_BIND|MS_REC): ok\n after cycle: Shmem: 65916 kB\n\ndo_move_mount() runs check_for_nsfs_mounts() over a detached tree for\nexactly that reason. Do the same for the copy before it is grafted."}], "id": "CVE-2026-98989", "lastModified": "2026-11-10T19:22:28.763", "metrics": {}, "published": "2026-10-23T13:17:20.863", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/37a82f400efa4d263542a5fa41755b21057f1e5d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a0ba48256f5dff6f75a45f8ce39fe57f21df1022"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b82f3c1131456537a514595c3991b62652507c9d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c640a01a78e42302879006ed7b7d5a9a943ba815"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: namespace: check a recursive bind mount for mount namespace loops", "id": "2559709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559709"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnamespace: check a recursive bind mount for mount namespace loops\ndo_loopback() refuses to bind mount the file of a mount namespace that\nis as old as the caller's or older because a mount namespace that holds\na mount of its own file, or of an ancestor's, would cause a cycle. But\nit only checks the dentry the bind mount starts from. With MS_REC\neverything below it is copied and do_loopback() passes\nCL_COPY_MNT_NS_FILE so mount namespace files below the source are\ncopied.\nThat's fine for a source in the caller's own mount namespace. Every\nmount namespace file in there passed the same check when it was\nbind-mounted. It isn't fine for a source in another mount namespace.\nmay_copy_tree() accepts a bind mount of any nsfs or pidfs file no matter\nwhat mount namespace it lives in so that /proc/<pid>/ns/<ns> and pidfds\ncan be bind mounted. If we create a bind-mount stack of mount namespaces\nfile descriptors the kernel will copy them irrespective of their\nancestoral relationship to the mount namespace in question:\n151 146 0:7 net:[4026531833] /tmp/nrc/y rw - nsfs nsfs rw\n152 151 0:7 mnt:[4026532293] /tmp/nrc/y rw - nsfs nsfs rw\nMount 152 is a mount of the mount namespace file of mount namespace\n4026532293 inside mount namespace 4026532293. That namespace and every\nmount in it are leaked... All it takes is a process in an older mount\nnamespace that stacks the file and repeating it leaks without limit:\nafter control: Shmem: 380 kB\nchild: mount(/proc/self/fd/6, MS_BIND|MS_REC): ok\nafter cycle: Shmem: 65916 kB\ndo_move_mount() runs check_for_nsfs_mounts() over a detached tree for\nexactly that reason. Do the same for the copy before it is grafted.", "A flaw was found in the Linux kernel. A local user can exploit this vulnerability by performing recursive bind mounts containing mount namespace file descriptors, bypassing loop detection mechanisms. This issue creates cyclical mount references, preventing the kernel from freeing associated namespaces and mount data. Consequently, repeated exploitation leads to unbounded kernel memory consumption, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98989", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98989\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98989\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98989.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e149ed2b805fefdccf7ccdfc19eca22fdd4514ac,a0ba48256f5dff6f75a45f8ce39fe57f21df1022)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e149ed2b805fefdccf7ccdfc19eca22fdd4514ac,37a82f400efa4d263542a5fa41755b21057f1e5d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e149ed2b805fefdccf7ccdfc19eca22fdd4514ac,c640a01a78e42302879006ed7b7d5a9a943ba815)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e149ed2b805fefdccf7ccdfc19eca22fdd4514ac,a0ba48256f5dff6f75a45f8ce39fe57f21df1022)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e149ed2b805fefdccf7ccdfc19eca22fdd4514ac,37a82f400efa4d263542a5fa41755b21057f1e5d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e149ed2b805fefdccf7ccdfc19eca22fdd4514ac,c640a01a78e42302879006ed7b7d5a9a943ba815)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T17:00:15.616224+00:00", "updated": "2026-10-29T22:00:09.198277+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}