In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. (CVE-2026-98978)

The vulnerability in the Linux kernel involved the improper handling of locked mounts during unmount operations. Locked mounts are special mounts that protect underlying files and directories from exposure. While do_umount() refused to unmount locked mounts, the shrink_submounts() function did not, allowing a locked mount to be expired if it was beneath an unlocked ancestor mount. This could lead to the covered directory being revealed. The fix ensures that locked mounts are never expired independently and remain locked until their parent mount is unmounted. The expiry logic was updated so that mark_mounts_for_expiry() and lock_mnt_tree() exclude locked mounts from expiry lists, preventing premature unmounting and exposure of protected directories.

The vulnerability could allow the exposure of files and directories that were intended to be protected by locked mounts due to premature unmounting of locked mounts beneath unlocked ancestors. This could lead to unauthorized access to hidden filesystem content. The fix prevents this by ensuring locked mounts are only unmounted as part of their parent mount, preserving the intended protection.

A fix has been implemented in the Linux kernel to address this vulnerability by changing the expiry and locking behavior of mounts. Users should update to the patched kernel version once available. No additional mitigation steps are indicated beyond applying the official fix.