fs: don't silently unmount busy mounts
In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those functions from propagation hell. It skips a copy that has child mounts except for the case of a single child mount covering the copy's root. That algorithm used to be exact. It isn't anymore. Originally only childless copies were unmounted during propagation. And 1064f874abc0 ("mnt: Tuck mounts under others instead of creating shadow/side mounts.") ended up adding covered mounts to both sides in one go. Along came 99b19d16471e ("mnt: In propgate_umount handle visiting mounts in any order") and that started to unmount more than before: [1]: A copy of a mount is unmounted when each of its children is either its overmount or a copy of the victim itself. In the former case the overmount gets reparented. In the latter case the copy of the victim will end up being unmounted. So propagate_umount() ended up being rewritten without adjusting propagate_mount_busy(). And currently propagate_mount_busy() doesn't look at copies of the victim that have two or more children nor a single child that is not the overmount. So any such copy in [1] is not checked for references. The result is that a synchronous unmount succeeds, pulling out a mount that is still in use. A container can run into this with
CVE-2026-98996
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98996
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "99b19d16471e9c3faa85cad38abc9cbbe04c6d55",
"lessThan": "bf2c8dec26fb792876b5e9bde7030c45d8be3908",
"versionType": "git"
},
{
"status": "affected",
"version": "99b19d16471e9c3faa85cad38abc9cbbe04c6d55",
"lessThan": "a210ac218c307513d43e98a08f23c2dfbeeebc2f",
"versionType": "git"
},
{
"status": "affected",
"version": "99b19d16471e9c3faa85cad38abc9cbbe04c6d55",
"lessThan": "6857e209015f95be7a8f19a9cd5dac345b9b9859",
"versionType": "git"
},
{
"status": "affected",
"version": "dc5ce95b0252d143497283f7f659840d4f8a79d0",
"versionType": "git"
},
{
"status": "affected",
"version": "fdb8f10499924d96b8eb60cc1354b278f6fcf0e9",
"versionType": "git"
},
{
"status": "affected",
"version": "bb4fbf094b440a9209ed88c8681960d4b26eec0f",
"versionType": "git"
},
{
"status": "affected",
"version": "b43f81ef0babcc07db1eaaece37c989204e4ff00",
"versionType": "git"
},
{
"status": "affected",
"version": "81311d1698c0c87c972ba71d3ce44a617b52ea21",
"versionType": "git"
},
{
"status": "affected",
"version": "4.1.43",
"lessThan": "4.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.4.78",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.9.39",
"lessThan": "4.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.11.12",
"lessThan": "4.12",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.12.3",
"lessThan": "4.13",
"versionType": "semver"
}
],
"programFiles": [
"fs/pnode.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/pnode.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98996
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #52841 · Revision 1
- Added to Heist Feed
- Publisher date