CVE-2026-98989: Linux kernel · namespace: check a recursive bind mount for mount namespace loops
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 28 Oct 2026, 02:00 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.10linuxpkg:deb/ubuntu/linux?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-oraclepkg:deb/ubuntu/linux-oracle?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available that enhances kernel checks to detect and prevent recursive mount namespace loops before grafting copied mount trees. Users should apply the updated linux-aws kernel versions that include this fix. No additional mitigation actions are indicated.
Description
CVE-2026-98989 is a Linux kernel vulnerability involving recursive bind mounts of mount namespace files that can create mount namespace loops. The kernel's do_loopback() function checks for cycles only at the starting dentry of a bind mount, but with MS_REC recursive bind mounts, mount namespace files from other namespaces can be copied without proper cycle detection. This can lead to unbounded resource leaks by stacking mount namespace file descriptors recursively. The issue affects specific linux-aws kernel versions and has been resolved by enhancing checks before grafting the copied mount tree.
References
- ubuntu.com/security/CVE-2026-98989 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-98989 (opens in a new tab)
- git.kernel.org/stable/c/37a82f400efa4d263542a5fa41755b21057f1e5d (opens in a new tab)
- git.kernel.org/stable/c/a0ba48256f5dff6f75a45f8ce39fe57f21df1022 (opens in a new tab)
- git.kernel.org/stable/c/c640a01a78e42302879006ed7b7d5a9a943ba815 (opens in a new tab)