PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-98992 Linux CVE debrief

A Linux kernel vulnerability allows copying an unmounted mount tree, potentially leading to unintended mount propagation. This issue arises from the may_copy_tree() function accepting mounts with roots in nsfs or pidfs files before checking if they are mounted. Bind-mounting a namespace or pidfd that was lazily unmounted and kept alive by a file descriptor could lead to the entire unmounted stack being copied with MS_REC or AT_RECURSIVE copy_tree().

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-30
Advisory published
2026-10-23
Advisory updated
2026-10-30

Who should care

Linux administrators and users, security teams responsible for Linux systems, and developers working with Linux kernel modules. They should verify kernel versions, review mount configurations, and monitor for potential exploitation attempts. This vulnerability in the Linux kernel could allow unintended mount propagation, potentially leading to security issues if exploited.

Why it matters

This vulnerability in the Linux kernel could allow unintended mount propagation, potentially leading to security issues if exploited. Linux administrators and security teams should verify kernel versions, review mount configurations, and monitor for potential exploitation attempts.

  • Verify mount configurations to prevent unintended propagation
  • Assess Linux kernel versions for vulnerability and apply patches
  • Monitor system logs for potential exploitation attempts

Technical summary

The Linux kernel vulnerability involves the may_copy_tree() function, which did not properly check if a mount was mounted before accepting it. This could lead to copying an unmounted mount tree when using bind-mounts of namespaces or pidfds that were lazily unmounted. The vulnerability allows unintended mount propagation, potentially leading to security issues if exploited. Linux administrators and security teams should verify kernel versions, review mount configurations, and monitor for potential exploitation attempts.

Defensive priority

Medium

Recommended defensive actions

  • Review Linux kernel versions and patches to ensure fixes are applied
  • Verify mount propagation configurations
  • Monitor for potential exploitation attempts
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and Linux kernel source code indicate a fix for the vulnerability. Specific version details and potential workarounds require verification from official Linux sources. Linux administrators should verify kernel versions, review mount configurations, and monitor for potential exploitation attempts. The vulnerability involves the may_copy_tree() function, which did not properly check if a mount was mounted before accepting it. This could lead to copying an unmounted mount tree when using bind-mounts of namespaces or pidfds

Sources and references

Verified primary and authoritative sources

  • CVE-2026-98992 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-98992

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-98992 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-98992

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • namespace: don't copy an unmounted mount tree

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98992.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/94d05b62dc7aea236db20166e79ee002e466393a

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/07c6a8f004bcc58b4ccf993e6efa7b9b8b4a1b8b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/31cf157298271392ab5fb0805b28d37c8d7a8057

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/86a2d56b1960720bf1844441c0890621e9db2f25

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7e037b1fd339d865737c8accd29abcf40130a5a0

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b47b40c4f058418f9707454543179df240796aad

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8d3527457e183cedee3003c2897314da49488311

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.