In the Linux kernel, the following vulnerability has been resolved: namei: don't reveal overmounted entries in refwalk In rcuwalk the dentry is… (CVE-2026-98980)

The vulnerability in the Linux kernel involved the refwalk mechanism in the namei path resolution code. While rcuwalk validates dentries to avoid revealing overmounted entries, refwalk did not perform the same checks, allowing a narrow race condition where an unlink operation on a mountpoint could cause refwalk to reveal the underlying entry beneath the mount. This occurs because refwalk takes a reference on the hashed dentry and does not detect unlinks that happen afterward, exposing potentially sensitive underlying files. The fix involved adding checks for the DCACHE_CANT_MOUNT flag on dentries after step_into() to detect and prevent traversal of unlinked mountpoints, ensuring that refwalk does not reveal overmounted entries.

The vulnerability could allow processes performing refwalk operations to read or access files that were unlinked but still visible due to mount detachment, potentially exposing underlying filesystem entries that should be hidden. This is a narrow race condition and requires specific timing with unlinks on mountpoints. There are no reports of known exploits in the wild.

A fix has been implemented in the Linux kernel to address this issue by adding checks for unlinked mountpoints during refwalk traversal. Users should apply the official kernel updates that include this patch to mitigate the vulnerability. No additional mitigation actions are indicated by the vendor advisory.