In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context… (CVE-2026-98986)

The vulnerability (CVE-2026-98986) in the Linux kernel concerns the removal of fsnotify marks from mount namespaces. The function mnt_ns_release() drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotify_mntns_delete(), which takes mutexes and spinlocks safely in process context. However, mnt_ns_tree_remove() passes the namespace reference to call_rcu(), causing marks to be removed in RCU softirq context, which is invalid and leads to kernel BUGs due to sleeping functions called from an invalid context. This occurs when a fanotify group with a FAN_MARK_MNTNS mark exists on the mount namespace of another task, and a root user in a user namespace can exploit this by marking a mount namespace it owns. The fix removes the marks earlier in free_mnt_ns(), which runs in process context, ensuring safe removal and preventing the bug.

The vulnerability causes kernel BUGs due to improper locking and context usage during mount namespace release, potentially leading to system instability or crashes. It requires root privileges in a user namespace to exploit and involves manipulation of fanotify marks on mount namespaces. There is no indication of remote exploitation or privilege escalation beyond the root user in a user namespace context.

A fix has been implemented that removes the fsnotify marks in free_mnt_ns() before the namespace is handed to RCU, ensuring the removal occurs in process context and preventing the invalid context bug. Users should update to the fixed Linux kernel version once available. Patch status is not explicitly stated in the input; therefore, check the vendor advisory for current remediation guidance.