In the Linux kernel, the following vulnerability has been resolved: namespace: don't copy an unmounted mount tree may_copy_tree() accepts a mount… (CVE-2026-98992)

The Linux kernel vulnerability (CVE-2026-98992) concerns the namespace subsystem where may_copy_tree() improperly accepts mounts with nsfs or pidfs roots without confirming if they are mounted. This exception, intended for nsfs and pidfs mounts, inadvertently permits recursive copying of unmounted mount trees if they are kept alive by file descriptors. Specifically, with MS_REC or AT_RECURSIVE flags, copy_tree() would copy all mounts attached to the unmounted mount, which is a bug. The fix enforces refusal to walk unmounted trees during recursive copying, returning EINVAL on such attempts, while still allowing copying of the root alone if pinned by a file descriptor.

This vulnerability could lead to unintended recursive copying of unmounted mount trees in the Linux kernel namespace subsystem. While the exact security impact is not detailed, such behavior could potentially cause incorrect system state or resource handling. There are no known exploits in the wild. The fix prevents this unintended recursive copying, improving kernel namespace mount handling correctness.

A fix for this vulnerability has been implemented in the Linux kernel to refuse walking unmounted mount trees during recursive copy operations. Users should update to the fixed kernel version once available. No additional mitigation actions are specified or required beyond applying the official fix.