In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are… (CVE-2026-98977)

The vulnerability in the Linux kernel concerned the handling of mount locking for automounts when mounts are propagated across user namespaces. The function attach_recursive_mnt() locked every copy of the source mount to protect overmounts, but it incorrectly locked the host's mount in some cases involving automounts and user namespaces. This caused the host to be unable to change the flags on its own mounts, while the child namespace could. The fix changes the logic to compare with the owner of the namespace where the mount actually gets mounted, ensuring the correct mount copy is locked. This resolves the issue with mount flag management and locking in scenarios involving automounts and user namespaces.

The vulnerability could cause the host's mount to be locked incorrectly, preventing the host from changing mount flags such as remount options. This could lead to inconsistent mount states and potential denial of expected mount flag changes on the host. There is no indication of privilege escalation or arbitrary code execution from the provided data.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel update that includes the corrected mount locking behavior for automounts across user namespaces. No additional mitigation steps are indicated.