In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath… (CVE-2026-98976)

The vulnerability involves the Linux kernel's mount namespace propagation mechanism. Specifically, the function attach_recursive_mnt() transfers the MNT_LOCKED property from a top mount to a mount moved beneath it during MOVE_MOUNT_BENEATH operations. This behavior allows a user namespace owner to replace a locked /proc or root mount by exploiting the transfer of the locked property to propagated mounts beneath the original locked mount. Consequently, when the original mount is unmounted, the covering mount becomes unlocked, allowing the user namespace to unmount it and access files that should remain hidden. The fix restricts the transfer of the locked property to mounts explicitly placed by the caller, ensuring that propagated copies beneath locked mounts remain locked and continue to cover the underlying mountpoints as expected.

An attacker with ownership of a user namespace could exploit this vulnerability to unmount a covering mount that was intended to protect sensitive files, thereby gaining unauthorized access to those files. This could lead to information disclosure within the affected namespace. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, users should monitor vendor communications for patches addressing this mount namespace locking issue. No specific temporary mitigations are provided in the available data.