In the Linux kernel, the following vulnerability has been resolved: namespace: check a submount for references right before unmounting it… (CVE-2026-98990)

The vulnerability in the Linux kernel's namespace subsystem involves the functions shrink_submounts() and mark_mounts_for_expiry(), which collect mounts to unmount but do not properly verify if mounts are busy at the time of unmounting. The unmounting of one mount alters the mount tree, causing propagate_umount() to move surviving overmounts and potentially misclassify busy mounts as unreferenced. This leads to a synchronous unmount of mounts still in use, marked with MNT_SYNC_UMOUNT, violating expected mount reference semantics. The issue specifically affects mounts flagged as MNT_SHRINKABLE, including automounted submounts of network filesystems like NFS, AFS, CIFS, and certain debugfs mounts. The resolution involves checking each mount for references immediately before unmounting while holding namespace_sem and mount_lock to ensure linear and correct unmounting behavior.

The vulnerability could cause mounts that are still in use to be unmounted synchronously, potentially leading to filesystem inconsistencies or unexpected behavior in processes relying on those mounts. This affects automounted submounts with the MNT_SHRINKABLE flag, including network filesystem mounts and certain debugfs mounts. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to check each mount for references immediately before unmounting it, under the same locks as the unmount operation. Users should apply the official kernel update that includes this fix once available. No additional mitigation steps are indicated beyond applying the patch.