In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt_notify_add() puts… (CVE-2026-98991)

The Linux kernel vulnerability (CVE-2026-98991) arises from mnt_notify_add() adding mounts to the notify_list without verifying if they are already queued. During multiple umount_tree() calls under a single namespace_sem hold, mounts can be reparented and queued multiple times, corrupting the notification list. This leads to use-after-free errors when later mount operations access freed memory, triggering kernel slab-use-after-free bugs detected by KASAN. The issue specifically involves mounts marked MNT_SHRINKABLE, commonly found in submounts of network filesystems and tracefs. The fix involves initializing the to_notify list in alloc_vfsmnt() and ensuring mounts already queued are not added again, accepting that some move events may be lost but preventing memory corruption.

This vulnerability can cause kernel memory corruption through use-after-free conditions, potentially leading to kernel crashes or instability. It affects mounts with the MNT_SHRINKABLE flag and can cause kernel slab-use-after-free errors detected by KASAN. There is no indication of remote exploitation or privilege escalation in the provided data. The impact is primarily on kernel stability and reliability during mount operations.

A fix has been implemented in the Linux kernel to initialize the notification list properly and prevent mounts from being queued multiple times. Users should apply the official kernel update that includes this fix once available. Since this is a kernel-level issue, upgrading to the patched kernel version is the recommended mitigation. No other specific workarounds are indicated.