CVE-2026-98993 is a Linux kernel vulnerability involving improper handling of the MNT_UMOUNT flag during mount namespace cloning. The flaw causes mounts that have been lazily unmounted but are still referenced to incorrectly inherit the MNT_UMOUNT flag, leading to various mount namespace inconsistencies, including leaked mounts, unmounting errors, and potential use-after-free conditions. This issue affects specific linux-aws kernel versions and has a high severity rating with a CVSS score of 7.8.
CVE-2026-98992 is a vulnerability in the Linux kernel's namespace handling where the function may_copy_tree() improperly copies an unmounted mount tree. This occurs because the function accepts mounts whose roots are nsfs or pidfs files before verifying if they are mounted, allowing recursive copying of unmounted mount stacks. The issue arises when bind mounting a namespace file descriptor that was lazily unmounted but still kept alive by a file descriptor, leading to unintended copying of the entire unmounted mount stack. The fix involves refusing to recursively walk unmounted mount trees, returning an error instead.
CVE-2026-98991 is a high-severity vulnerability in the Linux kernel related to mount notification handling. The flaw arises because the kernel function mnt_notify_add() can queue a mount multiple times without checking if it is already queued, leading to use-after-free memory access. This occurs during complex mount namespace operations involving multiple unmounts under a single namespace semaphore hold. The issue can cause kernel memory corruption and crashes due to accessing freed memory. The vulnerability affects specific Linux kernel versions listed and has a CVSS score of 7.8. A fix involves initializing the notification list properly and ensuring mounts are queued only once.
CVE-2026-98990 is a Linux kernel vulnerability involving improper reference checks on submounts before unmounting. The flaw allows a synchronous unmount operation to incorrectly remove a busy mount that is still in use elsewhere, potentially leading to unreachable current working directories. This issue affects certain automounted submounts with the MNT_SHRINKABLE flag, such as NFS, AFS, CIFS, and tracefs mounts. The problem arises because the unmounting algorithm does not re-check references after modifying the mount tree, causing busy mounts to be unmounted improperly.
CVE-2026-98989 is a Linux kernel vulnerability involving recursive bind mounts of mount namespace files that can create mount namespace loops. The kernel's do_loopback() function checks for cycles only at the starting dentry of a bind mount, but with MS_REC recursive bind mounts, mount namespace files from other namespaces can be copied without proper cycle detection. This can lead to unbounded resource leaks by stacking mount namespace file descriptors recursively. The issue affects specific linux-aws kernel versions and has been resolved by enhancing checks before grafting the copied mount tree.
CVE-2026-98988 is a Linux kernel vulnerability related to the handling of mount namespaces created by open_tree(OPEN_TREE_NAMESPACE). It involves improper handling of covered mounts when copying mount namespaces, allowing unprivileged users to potentially access hidden files under covered mounts. The flaw arises because covered mounts are not kept covered in the new namespace under certain conditions, which container runtimes and administrators rely on to mask filesystem paths. This issue affects specific Linux kernel versions and has a high severity rating with a CVSS score of 8.8.
CVE-2026-98987 is a vulnerability in the Linux kernel related to mount namespace handling. The flaw involves the function attach_recursive_mnt() which incorrectly processes the topmost mount in a mount namespace file chain. This can cause mounts to be attached below the root of the mount namespace file, leading to issues such as inability to unmount certain mounts synchronously and incorrect file content visibility through bind mounts.
CVE-2026-98986 is a vulnerability in the Linux kernel related to improper removal of fsnotify marks on mount namespaces. The issue arises because marks are removed in an invalid context (RCU softirq) leading to a kernel BUG due to sleeping functions being called from this context. This can be triggered by root in a user namespace owning a mount namespace with a fanotify group mark. The fix involves removing marks in process context before the namespace is handed to RCU, preventing the invalid context operation.
CVE-2026-98985 is a Linux kernel vulnerability in the pivot_root() function related to namespace mount checks. The flaw occurs because path_pivot_root() reads the parents of new_root and the caller's root mounts without verifying that both mounts belong to the caller's mount namespace, potentially causing a use-after-free error. This issue was fixed by ensuring both mounts are checked to be in the caller's namespace before reading their parents. The vulnerability results in an invalid read but returns EINVAL, preventing further damage.
CVE-2026-98984 is a Linux kernel vulnerability involving the dcache subsystem where a mountpoint can be incorrectly placed on a dentry that is in the process of being removed. This occurs due to a race condition between detach_mounts() and d_delete() operations, allowing a bind mount of a directory being removed to be moved beneath an existing mount, resulting in a mountpoint on a removed directory that cannot be detached. The issue has been resolved by ensuring proper locking and checks to prevent mounts on dentries being removed.
A vulnerability in the Linux kernel's unshare system call can cause active namespace references to be dropped incorrectly when set_cred_ucounts() fails. This leads to the caller's namespaces losing references and not being listed by listns(), potentially causing inconsistent namespace state.
CVE-2026-98982 is a high-severity vulnerability in the Linux kernel affecting certain versions where a pseudo dentry can become the root of a mount. This occurs due to improper handling of pseudo dentries (used for pipes, sockets, etc.) that are not meant to be mount roots but can be bind-mounted via /proc/self/fd/<fd>. This leads to a use-after-free condition during mount namespace operations. The vulnerability allows an attacker with local privileges to cause a high-impact compromise including confidentiality, integrity, and availability.
A vulnerability in the Linux kernel's namespace handling allows a race condition during unlink, rmdir, and rename operations on mountpoint dentries. The issue arises because the dentry is not unhashed before detaching mounts, enabling lookups to access stale mount data during the race window. This can lead to unauthorized access to files or directories that should have been hidden by mounts. The flaw affects certain Linux kernel versions and has been assigned CVE-2026-98981 with a high severity rating.
CVE-2026-98980 is a high-severity vulnerability in the Linux kernel affecting certain versions of the linux-aws kernel. It involves the namei subsystem where overmounted entries can be revealed during a reference walk (refwalk). This occurs because refwalk does not properly detect unlinked mountpoints, potentially exposing underlying filesystem entries that should be hidden. The issue arises from differences in how lookups and refwalk handle dentries that are unlinked or detached from mounts. The vulnerability has been addressed by adding checks to ensure that entries marked as unlinked and unhashed are not erroneously revealed during refwalk.
CVE-2026-98979 is a vulnerability in the Linux kernel's namespace handling where an automount can be added below a mount that is not in the caller's mount namespace. This flaw allows dereferencing an error pointer leading to a kernel crash (general protection fault) and a null pointer dereference. The issue occurs during mount operations and can block all mount operations system-wide while the namespace semaphore is held. The problem is triggered via fanotify and overlay filesystem interactions. The fix involves using is_mounted() to reject unmounted and internal mounts, causing the open to fail gracefully with EINVAL as before.
CVE-2026-98978 is a vulnerability in the Linux kernel related to the handling of locked mounts within namespaces. Locked mounts are designed to protect underlying files and directories from being revealed. However, due to improper handling in the expiration logic, an unlocked ancestor mount could be unmounted in a way that reveals the contents of a locked mount beneath it. This vulnerability allows unauthorized access to protected directories by exploiting the mount expiration and unmounting sequence. The issue has been resolved by ensuring locked mounts are not expired independently and remain until their parent mounts are removed.
CVE-2026-98977 is a vulnerability in the Linux kernel related to incorrect handling of mount locking for automounts when mounts are propagated across user namespaces. The flaw causes the lock to be applied to the host's mount instead of the child's copy, preventing the host from changing mount flags and potentially leading to permission issues. This occurs because the kernel incorrectly assumes the user namespace of the caller's mount namespace is authoritative, which is not always true for automounts. The issue has been resolved by ensuring the lock is applied based on the namespace where the mount actually occurs.
CVE-2026-98976 is a Linux kernel vulnerability involving improper lock handling on mounts when a propagated copy is moved beneath another mount. This flaw allows a user namespace owner to replace a locked /proc or root mount, potentially exposing sensitive data by unmounting covers that should remain locked. The issue arises from transferring the locked property incorrectly during mount propagation, enabling unauthorized unmount operations and data exposure.
CVE-2026-98975 is a vulnerability in the Linux kernel's XFS filesystem related to improper handling of reflink flags during extent exchanges between files. The flaw occurs when exchanging mappings that cover both files from offset 0 to the disk size, causing incorrect assumptions about shared blocks beyond the file size. This can lead to in-place writes instead of copy-on-write (CoW), resulting in corruption of shared data. The issue affects the XFS_IOC_SWAPEXT operation similarly, where reflink flags were improperly moved between inodes. The fix involves stopping the exchange of reflink flags and ensuring both inodes maintain the flag correctly. The vulnerability has a CVSS score of 7.8 (high severity).
CVE-2026-98974 is a vulnerability in the Linux kernel's XFS filesystem related to the XFS_IOC_EXCHANGE_RANGE ioctl with the TO_EOF flag. The flaw causes incorrect file size handling during range exchanges, allowing files to have shared blocks beyond their end-of-file (EOF), which is invalid. This leads to incorrect clearing of reflink flags and enables writes that overwrite shared blocks past EOF, potentially causing data corruption. The issue arises from swapping on-disk and in-core file sizes incorrectly when nonzero offsets are used. The vulnerability affects multiple Linux kernel versions and has a CVSS score of 7.8 (high severity).