In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE… (CVE-2026-98988)

The vulnerability in the Linux kernel's namespace subsystem involved the open_tree(OPEN_TREE_NAMESPACE) call, which creates a new mount namespace by copying a tree at a given path. Previously, unprivileged users could create a non-recursive copy of a mount that had mounts below the requested directory, potentially exposing covered mounts that should remain hidden. The fix enforces that when the caller's user namespace does not own the source mount namespace, non-recursive copies are refused if mounts exist below the requested directory, and unbindable mounts are copied in recursive copies. This prevents unprivileged users from revealing covered mounts, preserving the intended mount namespace isolation.

The vulnerability could allow unprivileged users to access files or directories that are supposed to be hidden by covered mounts, undermining container runtime security and administrative mount hiding. This could lead to unauthorized information disclosure within the affected system. However, exploitation requires specific conditions involving user and mount namespace privileges.

The vulnerability has been resolved in the Linux kernel. Users and administrators should apply the official kernel updates that include this fix to ensure mount namespace isolation is correctly enforced. No additional mitigation is required once the patch is applied.