In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active… (CVE-2026-98983)

The vulnerability in the Linux kernel relates to the unshare system call improperly dropping active namespace references that were never taken. Specifically, active references on namespaces of an nsproxy are managed when the nsproxy is installed into a task and dropped when it is deactivated. However, ksys_unshare() erroneously calls put_nsproxy() on an nsproxy that was never installed if set_cred_ucounts() fails, decrementing namespace references incorrectly. This leads to namespaces the caller lives in not being listed by listns(). The failure of set_cred_ucounts() occurs only when alloc_ucounts() cannot allocate and the real UID differs from the effective UID. The fix involved using nsproxy_free() to properly free nsproxy instances that were prepared but never installed, aligning the handling with the behavior used in failed setns() calls.

The impact is that namespace references can be incorrectly decremented, causing the namespaces the caller lives in to disappear from namespace listings. This could lead to inconsistencies in namespace management within the kernel, potentially affecting processes relying on accurate namespace information. There is no indication of direct exploitation or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this issue by properly handling nsproxy references during unshare operations. Users should update to the fixed kernel version once available. Since this is a kernel-level fix, applying the official kernel update or patch from the Linux distribution vendor is the recommended remediation.