In the Linux kernel, the following vulnerability has been resolved: namespace: refuse an automount below a mount that is in no namespace It's… (CVE-2026-98979)

The Linux kernel contained a vulnerability where automounts could be added below a mount that was not in the caller's mount namespace, due to clone_private_mount() using the MNT_NS_INTERNAL flag. This caused attach_recursive_mnt() and count_mounts() to dereference an error pointer, leading to a null pointer dereference and kernel crash (general protection fault) when accessed via fanotify on overlay filesystem layers. The fix replaces the flawed check with is_mounted(), which correctly rejects unmounted and internal mounts, preventing the crash and maintaining mount namespace integrity.

Exploitation of this vulnerability can cause a kernel crash (general protection fault) resulting in denial of service. The crash occurs when user space triggers the flaw via fanotify on certain overlay filesystem layers, causing the kernel to dereference an invalid pointer. This also blocks all mount operations system-wide due to a held namespace semaphore, impacting system stability.

A fix has been implemented in the Linux kernel that replaces the flawed mount namespace check with a safer function that rejects invalid mounts. Users should update to the patched kernel version once available. No additional mitigation is described or required beyond applying the official fix.