In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloc_pseudo()… (CVE-2026-98982)

The vulnerability in the Linux kernel concerns the handling of pseudo dentries created by d_alloc_pseudo(), which are used for files like pipes and sockets that do not have parent or child dentries. Normally, these dentries carry the DCACHE_NORCU flag and are freed immediately by dentry_free() because they cannot be reached by lockless path walks. However, bind mounting /proc/self/fd/<fd> of such a file can make a pseudo dentry the root of a mount, violating this assumption. This leads to a race condition during mount cloning and unmounting where the root dentry can be freed while still being referenced, causing potential use-after-free scenarios. The vulnerability is specifically triggered by bpf_token_create(), which places token files on a bpffs mount in the caller's mount namespace, allowing the problematic mount cloning sequence. The patch refuses to clone mounts with a DCACHE_NORCU dentry as root, mitigating the issue.

The vulnerability can cause kernel instability or crashes due to use-after-free conditions when pseudo dentries become the root of a mount and are freed while still being accessed. This could potentially be exploited to cause denial of service or other unintended kernel behavior. However, no known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel that refuses to clone mounts whose root is a pseudo dentry with the DCACHE_NORCU flag. Users should update to a kernel version that includes this patch once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.