In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists… (CVE-2026-98996)

The Linux kernel vulnerability (CVE-2026-98996) involves the propagate_mount_busy() helper function, which determines if a synchronous unmount can proceed by examining copies of mounts in propagation trees. Changes in mount propagation handling caused propagate_mount_busy() to skip checks on copies with multiple children or a single child that is not an overmount. This omission allowed synchronous unmounts to succeed on mounts still in use, effectively detaching them silently. The issue is demonstrated in container scenarios where the container's mount tree shares propagation with the host, and the host unmounts a mount that remains referenced inside the container. The fix involves updating propagate_mount_busy() to perform the same thorough checks as propagate_umount(), ensuring mounts with active references are not unmounted prematurely.

The vulnerability allows a synchronous unmount operation to succeed on mounts that are still in use, potentially causing mounts to be detached unexpectedly. This can disrupt container environments where mount trees are shared with the host, leading to inconsistent mount states and possible application errors or data access issues within containers. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to update propagate_mount_busy() to correctly check mount references before unmounting. Users should apply the official kernel updates that include this fix once available. Since this is a kernel-level issue, remediation requires updating to a patched kernel version. Patch status is not explicitly confirmed in the provided data; users should consult the vendor or Linux kernel advisory for the current remediation status and apply updates accordingly.