In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's ->overmount in mnt_change_mountpoint()… (CVE-2026-98995)

The Linux kernel vulnerability involves improper handling of the ->overmount pointer in the mnt_change_mountpoint() function. While __umount_mnt() correctly resets the ->overmount pointer of the parent mount during unmount operations, mnt_change_mountpoint() did not, leaving the old parent pointing to the moved mount. This causes a dangling pointer and use-after-free scenario when a file descriptor keeps the unmounted mount alive. The fix resets the ->overmount pointer in mnt_change_mountpoint() similarly to __umount_mnt(), ensuring that a mount's ->overmount always points to a currently attached mount.

This vulnerability can lead to use-after-free conditions in the Linux kernel's mount namespace handling, potentially causing kernel memory corruption or crashes. However, no known exploits in the wild have been reported. The impact is limited to scenarios involving mount reparenting and file descriptors holding references to unmounted mounts.

A fix for this vulnerability has been implemented in the Linux kernel by resetting the old parent's ->overmount pointer in the mnt_change_mountpoint() function. Users should apply the official kernel updates that include this patch once available. Since this is a kernel-level issue, updating to the fixed kernel version is the recommended remediation.