CVE-2026-98987: Linux kernel · namespace: look at the topmost mount for a mount namespace file
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in b9c40553f6ceba50042281eef6f701e5fb719726 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 13:07 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in b9c40553f6ceba50042281eef6f701e5fb719726, 8714b44adac7b10506e1db3ef1710689751f0f10, 87ecd4c6da146363384a603bd9e90c90e7275536
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to b9c40553f6ceba50042281eef6f701e5fb719726, 8714b44adac7b10506e1db3ef1710689751f0f10 or 87ecd4c6da146363384a603bd9e90c90e7275536.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix has been implemented in the Linux kernel. Users should update to a fixed kernel version containing commits b9c40553f6ceba50042281eef6f701e5fb719726, 8714b44adac7b10506e1db3ef1710689751f0f10, or 87ecd4c6da146363384a603bd9e90c90e7275536. The affected version is 6.17, so upgrading to a later patched version is recommended.
Description
A vulnerability in the Linux kernel mount namespace handling was fixed by ensuring the topmost mount in a mount namespace file chain is properly considered. The flaw caused mount operations to incorrectly attach mounts below the root of the mount namespace file, leading to mounts that could not be accessed or unmounted synchronously.