CVE-2026-98985

What it actually does

Use-after-free read of a mount parent pointer in path_pivot_root when a mount referenced only by an open file descriptor is detached from its namespace; the kernel reads the parent under namespace_sem alone without first verifying the mount still belongs to the caller's namespace, allowing a freed slab object to be dereferenced.

Why it matters to the business

Kernel panic or memory corruption on systems running affected kernels can cause denial of service for workloads that perform pivot_root or chroot operations, with elevated urgency because the issue was published only two days ago and remains unpatched in many distributions.

How an attack unfolds

An attacker with local access opens a file descriptor to a mount, detaches that mount from its parent, then invokes pivot_root on the fd while racing a close that drops the final reference; the subsequent parent-pointer read in the kernel hits a freed object, triggering KASAN-detected slab-use-after-free.

How to fix it

Apply the upstream fix that adds namespace-membership checks before reading mnt_parent in path_pivot_root; rebuild and boot the patched kernel on all affected hosts. Until patches are available, restrict unprivileged use of pivot_root and chroot via seccomp or LSM policies.

How to confirm the fix worked

Boot a kernel containing the commit that adds the namespace check before the parent reads; confirm the KASAN report no longer triggers under the original reproducer; run regression tests exercising pivot_root and chroot from multiple mount namespaces.

Typical attack path

1. Obtain a file descriptor referencing a mount that can be unmounted while the fd remains open.
2. Unmount the mount so only the fd keeps it alive and its parent is no longer pinned.
3. Call pivot_root using the fd as new_root (or chroot affecting the caller's root).
4. Trigger the parent-pointer read before the RCU grace period expires, hitting the freed slab entry.
5. Observe kernel crash or, with further grooming, attempt to control the freed object contents.

How to detect it

Search kernel logs for KASAN reports containing path_pivot_root and slab-use-after-free; inspect audit records of pivot_root and chroot syscalls from processes that also close mount file descriptors; look for processes exiting immediately after these operations with kernel oops signatures.

What your security team should do

• Prioritize kernel updates on any system where unprivileged users can obtain mount file descriptors.
• Add the fix to internal kernel build pipelines and schedule rapid rollout within the CISA-style remediation window.
• Harden containers and sandboxes to deny pivot_root and chroot syscalls until kernels are updated.
• Monitor EPSS and exploit maturity; prepare incident response playbooks even though current scores remain low.