Cloudanix VulnDB

CVE-2026-98983

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recent Linux kernel bug can cause internal accounting errors when certain process-isolation commands run under unusual user-ID conditions, potentially leading to warnings or lost visibility into isolated environments.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A reference-counting error in ksys_unshare allows put_nsproxy to be called on an nsproxy that was never installed into a task when set_cred_ucounts fails, decrementing active namespace references below zero and leaving the caller's namespaces in an inconsistent state.

Why it matters to the business

Systems may experience kernel warnings, unexpected namespace disappearance from listns output, or instability during unshare operations that change real versus effective UID; the issue is new and carries negligible known exploitation risk.

How an attack unfolds

An attacker would need to trigger ksys_unshare while ensuring set_cred_ucounts fails due to alloc_ucounts inability, which occurs only when real UID differs from effective UID; no public exploits or threat-actor usage are known.

How to fix it

Upgrade to a kernel containing the referenced fix that uses nsproxy_free instead of put_nsproxy for the failed-unshare error path; apply the patch or the next stable kernel release that includes commit cefd55bd2159 and the unshare correction.

How to confirm the fix worked

Confirm the running kernel contains the upstream fix for this reference-handling path; attempt unshare operations under the UID-mismatch condition that previously triggered the warning and verify no __ns_ref_active_put warnings appear and listns output remains consistent.

Typical attack path

  1. Create a process with differing real and effective UID
  2. Call unshare with flags that allocate a new nsproxy
  3. Force set_cred_ucounts to fail so the error path invokes put_nsproxy on the uninstalled nsproxy
  4. Observe reference underflow warnings and subsequent namespace accounting corruption

How to detect it

Search kernel logs for the exact warning string from __ns_ref_active_put during unshare activity; inspect any post-unshare namespace enumeration failures or processes that disappear from namespace listings.

What your security team should do

  • Prioritize kernel updates on any systems that perform frequent unshare or container-creation operations
  • Monitor for the specific kernel warning in nscommon.c until patches are deployed
  • Review any custom code paths that call unshare after credential changes

The record

In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy(). But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using: WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid. Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.

Affected packages

Ecosystem Package Introduced Fixed