CVE-2026-98979

What it actually does

The vulnerability allows an attacker to create an automount below a mount that uses the internal MNT_NS_INTERNAL error pointer. When fanotify events on an overlay lower layer trigger attach_recursive_mnt and count_mounts, the kernel dereferences this error pointer, causing a null-pointer dereference and holding namespace_sem for write, which blocks all subsequent mount operations system-wide.

Why it matters to the business

Successful exploitation can crash or permanently hang Linux systems, halting all file-system operations and requiring a reboot; the issue affects any kernel still carrying the flawed namespace logic and can disrupt production workloads until patched.

How an attack unfolds

An attacker with the ability to set up an overlay filesystem and place a fanotify mark on its lower layer (for example debugfs) opens a path that causes clone_private_mount to succeed with MNT_NS_INTERNAL. Reading the resulting fanotify event then invokes attach_recursive_mnt and count_mounts under namespace_sem, dereferencing the invalid pointer and deadlocking the system.

How to fix it

Update the Linux kernel to a version containing the fix that replaces the MNT_NS_INTERNAL check with a call to is_mounted(), which correctly rejects both unmounted and internal mounts. Reboot affected systems after the update.

How to confirm the fix worked

Confirm the running kernel contains the commit that changes the namespace mount validation logic to use is_mounted(); attempt to reproduce the fanotify-plus-overlay reproducer and verify that openat now returns EINVAL instead of triggering the oops.

Typical attack path

1. Create an overlay mount whose lower layer is a filesystem that can be marked with fanotify (e.g., debugfs).
2. Place a fanotify filesystem mark on the lower layer.
3. Trigger an automount by opening a directory path inside the marked layer via the fanotify event file descriptor.
4. The kernel path through finish_automount and attach_recursive_mnt reaches count_mounts with an MNT_NS_INTERNAL pointer.
5. Null-pointer dereference occurs, kernel oops is logged, and namespace_sem remains held, blocking all mount operations.

How to detect it

Inspect kernel logs for general protection faults or KASAN null-ptr-deref reports inside count_mounts, attach_recursive_mnt, or finish_automount while namespace_sem is held; correlate with processes that recently performed fanotify marks on overlay lower layers.

What your security team should do

• Prioritize kernel updates on all Linux systems that expose fanotify or overlay mounts to untrusted users.
• Monitor vendor advisories for the exact upstream commit and backported packages.
• Restrict unprivileged use of fanotify and overlay mounts via seccomp or LSM policies until patches are applied.
• Reboot systems after kernel upgrades to clear any held namespace_sem state.