In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a… (CVE-2026-98993)

The Linux kernel vulnerability (CVE-2026-98993) concerns the improper inheritance of the MNT_UMOUNT flag in the clone_mnt() function. MNT_UMOUNT is set on mounts that have been unmounted lazily but are still referenced by file descriptors. clone_mnt() copied mount flags from the source mount but did not mask MNT_UMOUNT, causing new mounts to inherit this flag incorrectly. This led to several bugs: mounts being detached from namespaces prematurely and leaked, shared mounts losing peers, propagated unmounts skipping mounts incorrectly, and locked mounts being improperly committed and left unmounted under mounted parents. The fix involves adding MNT_UMOUNT to MNT_INTERNAL_FLAGS so clone_mnt() does not copy it, ensuring clones are always new mounts without the unmount flag. Additionally, warnings are added when umount_tree() encounters mounts with MNT_UMOUNT already set.

The vulnerability causes mounts to be incorrectly handled in mount namespaces, leading to resource leaks (mount namespaces leaking mounts), corrupted mount propagation state, and improper unmount behavior. This can result in mounts that cannot be unmounted via file descriptors, mounts being detached from their namespaces with incorrect reference counts, and potential kernel data structure corruption when namespaces are destroyed. These issues can degrade system stability and reliability but do not directly indicate privilege escalation or remote code execution.

A fix has been implemented in the Linux kernel that adds MNT_UMOUNT to the internal flags masked by clone_mnt(), preventing its inheritance. Users should apply the official Linux kernel update that includes this fix. Since this is a kernel vulnerability, upgrading to the patched kernel version is the recommended remediation. No additional mitigations are indicated by the vendor advisory.