Cloudanix VulnDB

CVE-2026-98992

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A Linux kernel bug lets certain file-system mount operations copy structures that should have been left alone after they were unmounted, which could weaken isolation between programs on the same machine.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

may_copy_tree() in the Linux kernel namespace code accepts a mount whose root is an nsfs or pidfs file before verifying it is mounted, allowing copy_tree() with MS_REC or AT_RECURSIVE to traverse and duplicate an entire unmounted mount stack that remains alive only via file descriptor.

Why it matters to the business

In container, namespace, or multi-tenant Linux environments the flaw can permit inconsistent mount namespace views or unexpected duplication of mount trees, increasing operational risk of isolation failures or local privilege escalation two days after disclosure.

How an attack unfolds

An attacker creates a bind mount of an nsfs or pidfs entry, opens a file descriptor to it, lazily unmounts the original path, then issues a recursive bind mount from the descriptor; the kernel's missing mounted-state check lets copy_tree() duplicate the unmounted stack and any overmounts.

How to fix it

Apply the upstream kernel commit that refuses to walk unmounted trees in copy_tree() while still permitting single-root bind mounts of namespace file descriptors; rebuild and reboot to the patched kernel.

How to confirm the fix worked

Confirm the patch is present by inspecting the may_copy_tree() and copy_tree() functions for the new unmounted-tree rejection logic, then test that recursive bind attempts on lazily unmounted nsfs/pidfs descriptors now return EINVAL.

Typical attack path

  1. mount --bind an nsfs/pidfs path to a temporary location
  2. open a file descriptor to the bind mount
  3. perform a lazy unmount on the temporary location
  4. issue mount --rbind or equivalent with MS_REC from the descriptor
  5. observe duplicated unmounted mount tree in the new namespace

How to detect it

Review kernel audit logs and mount-related system-call traces for sequences of bind, lazy-unmount, and recursive-bind operations involving /proc/*/ns or /proc/*/fd entries; correlate with unexpected mount namespace changes in container runtimes.

What your security team should do

  • Prioritize kernel updates on systems that heavily use containers or user namespaces
  • Audit workloads performing recursive bind mounts from namespace file descriptors
  • Monitor for upcoming stable kernel releases containing the fix

The record

In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount whose root is an nsfs or pidfs file before it checks whether that mount is mounted. This exception exists for nsfs and pidfs mounts. They are part of no mount namespace so neither check_mnt() nor is_mounted() would let them through and bind-mounting a nsfsfd or a pidfd wouldn't work. Problem is that exception also admits a bind mount of such a file when it was lazily unmounted and is only kept alive by a file descriptor: mount --bind /proc/self/ns/net /tmp/x exec 3< /tmp/x umount -l /tmp/x mount --rbind /proc/self/fd/3 /tmp/y With MS_REC or AT_RECURSIVE copy_tree() doesn't stop at the unmounted mount. It copies every mount that stayed attached to it as well. So if you have a bunch of overmounts over the nsfsfd or the pidfd the whole unmounted stack is copied. That's a bug. So refuse to walk an unmounted tree. Copying its root alone stays possible. So a bind mount of a namespace that is gone can still be recreated from a file descriptor on the old one. The file descriptor pins that mount and its root and __has_locked_children() only reads the direct children which don't leave the parent's list without namespace_sem. The internal mounts carry MNT_NS_INTERNAL instead of NULL and are still walked. Copying an unmounted tree recursively fails with EINVAL.

Affected packages

Ecosystem Package Introduced Fixed