In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink(), rmdir()… (CVE-2026-98981)

The Linux kernel vulnerability (CVE-2026-98981) concerns the namespace subsystem where during unlink(), rmdir(), and rename() operations, the dentry was not unhashed before detaching mounts. This left the dentry still hashed and visible in the dcache, allowing concurrent lookups to find the dentry and uncover mounts that should have been hidden. The race window includes the namespace_unlock() and inode_unlock() periods, which are significant. The fix involves calling d_drop() to unhash the dentry before proceeding with detach_mounts() and d_delete(), ensuring the dentry cannot be found during the race window. This corrects the ordering problem and closes the race condition.

This vulnerability could allow concurrent processes performing lookups to observe mount points that should have been detached, potentially leaking information about mount namespaces and filesystem structure during unlink, rmdir, or rename operations. While no direct code execution or privilege escalation is described, the exposure of mount information could aid attackers in understanding or interfering with namespace isolation.

A fix has been implemented in the Linux kernel to unhash the dentry before detaching mounts, closing the race condition. Users should update to the Linux kernel version that includes this patch once available. No vendor advisory or patch version is provided in the data; therefore, check the official Linux kernel mailing lists or vendor advisories for the specific fixed version and apply updates accordingly.