VulnerabilityPublished 28 Oct 2026

CVE-2026-99170: Linux kernel · namespace: a mount that copy_tree() leaves out can't take over a lock

Source GCVE Database

Authoritative record:CVE-2026-99170

Not known to be exploited : upgrade to bd71d33923b9d6216bcee44331dd37142b0a8441 or 69fbe94f80bc423613fa18dae6656757423732a2 soon.

Data as of 28 Oct 2026, 13:57 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Patch: Available – fixed in bd71d33923b9d6216bcee44331dd37142b0a8441, 69fbe94f80bc423613fa18dae6656757423732a2

Exploitation evidence

Disclosed: evidence found.
CVE published 28 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-fv9w-c66r-mfvr

What to do

Upgrade Linux kernel to bd71d33923b9d6216bcee44331dd37142b0a8441 or 69fbe94f80bc423613fa18dae6656757423732a2.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ c62a4766937edec2962d52e583276b459b739f2d, < bd71d33923b9d6216bcee44331dd37142b0a8441	Fixed in bd71d33923b9d6216bcee44331dd37142b0a8441
LinuxLinux	Affected ≥ c62a4766937edec2962d52e583276b459b739f2d, < 69fbe94f80bc423613fa18dae6656757423732a2	Fixed in 69fbe94f80bc423613fa18dae6656757423732a2
LinuxLinux	Affected =7.1	Fixed in–

AI-suggested

The vulnerability has been resolved in the Linux kernel by refusing to omit or move locked mounts of mount namespace files during copy_tree() and move_mount() operations. Users should apply the official kernel updates that include these fixes. Since this is a kernel vulnerability, updating to a fixed kernel version is the recommended remediation. No additional mitigations are indicated or required beyond applying the patch.

Description

CVE-2026-99170 is a Linux kernel vulnerability involving mount namespace handling where a mount that copy_tree() omits can take over a lock, allowing a root task in its own user namespace to remove a locked mount cover without a race or modifying the underlying filesystem. The issue arises from improper handling of locked mounts of mount namespace files during mount tree copying and moving operations. The vulnerability was addressed by refusing to leave out or move such locked mounts, preventing unshare() failures and unauthorized mount removals.

Impact

The vulnerability allows a root task in its own user namespace to bypass locked mount covers on files without race conditions or modifying the underlying filesystem, potentially exposing or masking files improperly. This undermines the intended mount namespace isolation and locking mechanisms, which could lead to unauthorized access or manipulation of filesystem views within user namespaces. The issue affects mount namespace security and could be leveraged to bypass file masking protections.

References

Community reviews

Loading reviews…