namespace: unhash a dentry before detaching the mounts on it
In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir() and rename() remove the entry from the filesystem, call detach_mounts() on the entry with the inode locked and then call d_delete() once the inode is unlocked. The thing is that between detach_mounts() and d_delete() the dentry is still hashed and positive. But after detach_mounts() nothing covers the dentry anymore. A lookup that finds this dentry in the dcache can uncover what the mounts hid. That's a problem when unlinking files or directories that are mountpoints in other mount namespaces. Everybody who had the underlying entry covered can race the detach_mount() call until d_delete() has run. The race window isn't all that small. It encompasses namespace_unlock() with a full synchronize_rcu_expedited() grace period and the inode_unlock() of the entry. In my experiments three walkers that kept trying read an overmounted file in 11938 of the 16140 unlinks that removed its mountpoint from a bind mount of the filesystem within a minute. Fun fact, d_invalidate() has the same ordering problem but gets it right. It unhashes the dentry first and detaches the mounts afterwards. Let's do the same in __detach_mounts(): - A lookup that hasn't found the dentry yet misses it in the dcache and waits for the directory lock that the caller holds until the name is gone for good. - A lockless lookup that found it already fails the mount_lock che
CVE-2026-98981
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98981
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"lessThan": "db90eecbde319527aa9480c039d32a0f5fe80574",
"versionType": "git"
},
{
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"lessThan": "8d71bfc9b3fc15d7103e82ea9dc5057541866e46",
"versionType": "git"
},
{
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"lessThan": "d29cd99db3db74cf3447be74d25740981789d461",
"versionType": "git"
},
{
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"lessThan": "8300de4aa5d09061bfcf2af5b52c0cdba3873185",
"versionType": "git"
},
{
"status": "affected",
"version": "8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe",
"lessThan": "528b383dc35d1e5caf64ddf5d35f983ae543b0d0",
"versionType": "git"
}
],
"programFiles": [
"fs/namespace.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/namespace.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98981
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #55720 · Revision 1
- Added to Heist Feed
- Publisher date