CVE-2026-98996: Linux kernel · fs: don't silently unmount busy mounts
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 28 Oct 2026, 01:59 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.10linuxpkg:deb/ubuntu/linux?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.10linux-oraclepkg:deb/ubuntu/linux-oracle?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix for this vulnerability is available. Users should update to patched Linux kernel versions that include the corrected propagate_mount_busy() logic. Since this is a kernel-level issue, applying the official kernel updates for the affected versions is the recommended remediation. No alternative mitigations or workarounds are indicated.
Description
CVE-2026-98996 is a vulnerability in the Linux kernel's mount propagation logic where busy mounts can be silently unmounted. This occurs because the propagate_mount_busy() helper function does not properly check references for certain mount copies with children, allowing a synchronous unmount to succeed even when the mount is still in use. This can lead to mounts being detached unexpectedly, particularly affecting container environments sharing mount trees with the host.
References
- ubuntu.com/security/CVE-2026-98996 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-98996 (opens in a new tab)
- git.kernel.org/stable/c/6857e209015f95be7a8f19a9cd5dac345b9b9859 (opens in a new tab)
- git.kernel.org/stable/c/a210ac218c307513d43e98a08f23c2dfbeeebc2f (opens in a new tab)
- git.kernel.org/stable/c/bf2c8dec26fb792876b5e9bde7030c45d8be3908 (opens in a new tab)