CVE-2026-98999 is a high-severity vulnerability in the Linux kernel's drm/xe graphics subsystem. It involves a stale pinned_link list entry caused by improper handling of buffer object (bo) pin and unpin operations, leading to a use-after-free condition when the bo is freed but the list still references it. This flaw arises because framebuffer pin/unpin operations bypass the pinned_link management used by external pin/unpin calls, leaving stale references that corrupt kernel memory. The issue has been fixed by consolidating pinned_link removal into a common unpin function that is called on all unpin paths, preventing stale list entries and memory corruption.
A flaw in the Linux kernel's drm/bridge th1520-dw-hdmi driver caused incorrect pointer handling during device removal, leading to improper teardown operations. The issue was fixed by correctly retrieving and passing the appropriate pointer type in the remove() callback.
A vulnerability in the Linux kernel's AMDGPU driver allowed improper acceptance of buffer objects (BOs) as doorbell BOs. This could lead to loss of buffer contents when a regular BO is incorrectly treated as a doorbell BO. The issue was fixed by restricting acceptance to only BOs created in the doorbell domain.
CVE-2026-98996 is a vulnerability in the Linux kernel's mount propagation logic where busy mounts can be silently unmounted. This occurs because the propagate_mount_busy() helper function does not properly check references for certain mount copies with children, allowing a synchronous unmount to succeed even when the mount is still in use. This can lead to mounts being detached unexpectedly, particularly affecting container environments sharing mount trees with the host.
CVE-2026-98995 is a high-severity vulnerability in the Linux kernel related to improper resetting of the old parent's ->overmount pointer in the mnt_change_mountpoint() function. This flaw can lead to a use-after-free (UAF) condition when a mount is moved and the old parent's ->overmount pointer incorrectly references a freed mount. This can cause the kernel to follow dangling pointers, potentially leading to privilege escalation or system compromise.
CVE-2026-98994 is a Linux kernel vulnerability involving the statmount functionality where the parent of an unmounted mount is read under mount_lock. This can lead to dereferencing a mount that has already been freed due to a race condition between statmount_mnt_basic() reading the parent mount and the final mntput() unmounting the children and freeing the parent. The issue arises because the parent mount is not properly pinned when the child mount is unmounted but kept alive by a file descriptor.
CVE-2026-98993 is a Linux kernel vulnerability involving improper handling of the MNT_UMOUNT flag during mount namespace cloning. The flaw causes mounts that have been lazily unmounted but are still referenced to incorrectly inherit the MNT_UMOUNT flag, leading to various mount namespace inconsistencies, including leaked mounts, unmounting errors, and potential use-after-free conditions. This issue affects specific linux-aws kernel versions and has a high severity rating with a CVSS score of 7.8.
CVE-2026-98992 is a vulnerability in the Linux kernel's namespace handling where the function may_copy_tree() improperly copies an unmounted mount tree. This occurs because the function accepts mounts whose roots are nsfs or pidfs files before verifying if they are mounted, allowing recursive copying of unmounted mount stacks. The issue arises when bind mounting a namespace file descriptor that was lazily unmounted but still kept alive by a file descriptor, leading to unintended copying of the entire unmounted mount stack. The fix involves refusing to recursively walk unmounted mount trees, returning an error instead.
CVE-2026-98991 is a high-severity vulnerability in the Linux kernel related to mount notification handling. The flaw arises because the kernel function mnt_notify_add() can queue a mount multiple times without checking if it is already queued, leading to use-after-free memory access. This occurs during complex mount namespace operations involving multiple unmounts under a single namespace semaphore hold. The issue can cause kernel memory corruption and crashes due to accessing freed memory. The vulnerability affects specific Linux kernel versions listed and has a CVSS score of 7.8. A fix involves initializing the notification list properly and ensuring mounts are queued only once.
CVE-2026-98990 is a Linux kernel vulnerability involving improper reference checks on submounts before unmounting. The flaw allows a synchronous unmount operation to incorrectly remove a busy mount that is still in use elsewhere, potentially leading to unreachable current working directories. This issue affects certain automounted submounts with the MNT_SHRINKABLE flag, such as NFS, AFS, CIFS, and tracefs mounts. The problem arises because the unmounting algorithm does not re-check references after modifying the mount tree, causing busy mounts to be unmounted improperly.
CVE-2026-98989 is a Linux kernel vulnerability involving recursive bind mounts of mount namespace files that can create mount namespace loops. The kernel's do_loopback() function checks for cycles only at the starting dentry of a bind mount, but with MS_REC recursive bind mounts, mount namespace files from other namespaces can be copied without proper cycle detection. This can lead to unbounded resource leaks by stacking mount namespace file descriptors recursively. The issue affects specific linux-aws kernel versions and has been resolved by enhancing checks before grafting the copied mount tree.
CVE-2026-98988 is a Linux kernel vulnerability related to the handling of mount namespaces created by open_tree(OPEN_TREE_NAMESPACE). It involves improper handling of covered mounts when copying mount namespaces, allowing unprivileged users to potentially access hidden files under covered mounts. The flaw arises because covered mounts are not kept covered in the new namespace under certain conditions, which container runtimes and administrators rely on to mask filesystem paths. This issue affects specific Linux kernel versions and has a high severity rating with a CVSS score of 8.8.
CVE-2026-98987 is a vulnerability in the Linux kernel related to mount namespace handling. The flaw involves the function attach_recursive_mnt() which incorrectly processes the topmost mount in a mount namespace file chain. This can cause mounts to be attached below the root of the mount namespace file, leading to issues such as inability to unmount certain mounts synchronously and incorrect file content visibility through bind mounts.
CVE-2026-98986 is a vulnerability in the Linux kernel related to improper removal of fsnotify marks on mount namespaces. The issue arises because marks are removed in an invalid context (RCU softirq) leading to a kernel BUG due to sleeping functions being called from this context. This can be triggered by root in a user namespace owning a mount namespace with a fanotify group mark. The fix involves removing marks in process context before the namespace is handed to RCU, preventing the invalid context operation.
CVE-2026-98985 is a Linux kernel vulnerability in the pivot_root() function related to namespace mount checks. The flaw occurs because path_pivot_root() reads the parents of new_root and the caller's root mounts without verifying that both mounts belong to the caller's mount namespace, potentially causing a use-after-free error. This issue was fixed by ensuring both mounts are checked to be in the caller's namespace before reading their parents. The vulnerability results in an invalid read but returns EINVAL, preventing further damage.
CVE-2026-98984 is a Linux kernel vulnerability involving the dcache subsystem where a mountpoint can be incorrectly placed on a dentry that is in the process of being removed. This occurs due to a race condition between detach_mounts() and d_delete() operations, allowing a bind mount of a directory being removed to be moved beneath an existing mount, resulting in a mountpoint on a removed directory that cannot be detached. The issue has been resolved by ensuring proper locking and checks to prevent mounts on dentries being removed.
A vulnerability in the Linux kernel's unshare system call can cause active namespace references to be dropped incorrectly when set_cred_ucounts() fails. This leads to the caller's namespaces losing references and not being listed by listns(), potentially causing inconsistent namespace state.
CVE-2026-98982 is a high-severity vulnerability in the Linux kernel affecting certain versions where a pseudo dentry can become the root of a mount. This occurs due to improper handling of pseudo dentries (used for pipes, sockets, etc.) that are not meant to be mount roots but can be bind-mounted via /proc/self/fd/<fd>. This leads to a use-after-free condition during mount namespace operations. The vulnerability allows an attacker with local privileges to cause a high-impact compromise including confidentiality, integrity, and availability.
A vulnerability in the Linux kernel's namespace handling allows a race condition during unlink, rmdir, and rename operations on mountpoint dentries. The issue arises because the dentry is not unhashed before detaching mounts, enabling lookups to access stale mount data during the race window. This can lead to unauthorized access to files or directories that should have been hidden by mounts. The flaw affects certain Linux kernel versions and has been assigned CVE-2026-98981 with a high severity rating.
CVE-2026-98980 is a high-severity vulnerability in the Linux kernel affecting certain versions of the linux-aws kernel. It involves the namei subsystem where overmounted entries can be revealed during a reference walk (refwalk). This occurs because refwalk does not properly detect unlinked mountpoints, potentially exposing underlying filesystem entries that should be hidden. The issue arises from differences in how lookups and refwalk handle dentries that are unlinked or detached from mounts. The vulnerability has been addressed by adding checks to ensure that entries marked as unlinked and unhashed are not erroneously revealed during refwalk.