In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivot_root()… (CVE-2026-98985)

The vulnerability in the Linux kernel affects the path_pivot_root() function, which reads the parents of new_root and the caller's root mounts and checks if they are shared before verifying namespace membership. The flaw is that new_root can reference an unmounted mount still alive due to a file descriptor, leading to a use-after-free when reading the parent mount without proper locking or namespace verification. This results in a kernel slab-use-after-free bug detected by KASAN. The resolution is to ensure both mounts are confirmed to be in the caller's mount namespace before reading their parents, with all paths returning EINVAL on failure, thus preventing unsafe memory access.

The vulnerability can cause a kernel use-after-free condition leading to a kernel bug and potential system instability or crashes. However, the error handling returns EINVAL, so no unauthorized access or privilege escalation is indicated by the provided data. There is no evidence of exploitation in the wild.

A fix has been implemented in the Linux kernel to check that both mounts are in the caller's namespace before reading their parents in pivot_root(). Users should apply the official kernel update that includes this fix once available. Patch status is not explicitly stated in the provided data; therefore, check the vendor advisory for current remediation guidance.