In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_loopback()… (CVE-2026-98989)

The Linux kernel's do_loopback() function prevents bind mounting a mount namespace file that is as old as or older than the caller's mount namespace to avoid cycles. However, this check only applies to the starting dentry of the bind mount. When using MS_REC, the kernel copies all mounts below the source, including mount namespace files from other namespaces, without verifying their ancestral relationship. This allows creating recursive bind mounts of mount namespace files, causing cycles and leaking kernel memory indefinitely. The vulnerability involves the kernel accepting bind mounts of nsfs or pidfs files from any mount namespace, enabling a process in an older mount namespace to stack these files and cause resource exhaustion. The fix involves running the check_for_nsfs_mounts() function on the copied tree before grafting it to prevent such cycles.

This vulnerability can lead to unbounded kernel memory leaks by creating recursive bind mounts of mount namespace files, potentially exhausting system resources. It does not describe privilege escalation or code execution but can degrade system stability and availability due to resource exhaustion.

A fix has been implemented in the Linux kernel to check for mount namespace loops before grafting copied mount trees during recursive bind mounts. Users should apply the official kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the current remediation status and apply updates accordingly.