{"id":"CVE-2026-98995","state":"PUBLISHED","title":"namespace: reset the old parent's ->overmount in mnt_change_mountpoint()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: reset the old parent's ->overmount in mnt_change_mountpoint()\n\n__umount_mnt() resets ->overmount of the parent when it unmounts the\nmount that overmounts it. mnt_change_mountpoint() doesn't. It moves the\nmount to its new parent and leaves the old one pointing at it.\n\nFor a mount that is moved beneath in attach_recursive_mnt() that doesn't\nmatter. The new mount has already reset ->overmount of the old parent by\nthe time the old top mount is moved onto it.\n\nIt matters for reparent() though. propagate_umount() moves a surviving\novermount onto the first ancestor that isn't going to be unmounted. The\nmount it was taken from is unmounted immediately afterwards. If a file\ndescriptor keeps that unmounted mount alive ->overmount points at the\nmoved mount. That's a dangling pointer and UAF as the moved mount is\nunmounted and freed.\n\ndo_lock_mount() follows ->overmount from the target path under\nmount_lock. With a file descriptor on such a mount as the target of a\nmount beneath topmost_overmount() walks into the freed mount and\ndo_lock_mount() takes references on whatever it finds there.\n\nSo reset ->overmount of the old parent in mnt_change_mountpoint() the\nsame way __umount_mnt() does. A mount's ->overmount is then always a\nmount that is attached to it.","publishedAt":"2026-10-23T12:20:14.155Z","updatedAt":"2026-10-24T14:09:55.095Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ffdc52fbbd5835a936ad683c943d6d103a2d4514","status":"affected","lessThan":"5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5","versionType":"git"},{"version":"ffdc52fbbd5835a936ad683c943d6d103a2d4514","status":"affected","lessThan":"08d575ee89393fd812dbdca7b5d7b4574cd5a564","versionType":"git"},{"version":"ffdc52fbbd5835a936ad683c943d6d103a2d4514","status":"affected","lessThan":"476ef286a7a5db8bda51325dc0c45887b4d99d9a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/namespace.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.17","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.11","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/namespace.c"]}],"references":["https://git.kernel.org/stable/c/5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5","https://git.kernel.org/stable/c/08d575ee89393fd812dbdca7b5d7b4574cd5a564","https://git.kernel.org/stable/c/476ef286a7a5db8bda51325dc0c45887b4d99d9a"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98995.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98995","state":"PUBLISHED","datePublished":"2026-10-23T12:20:14.155Z","dateUpdated":"2026-10-24T14:09:55.095Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.384Z"},"containers":{"cna":{"title":"namespace: reset the old parent's ->overmount in mnt_change_mountpoint()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: reset the old parent's ->overmount in mnt_change_mountpoint()\n\n__umount_mnt() resets ->overmount of the parent when it unmounts the\nmount that overmounts it. mnt_change_mountpoint() doesn't. It moves the\nmount to its new parent and leaves the old one pointing at it.\n\nFor a mount that is moved beneath in attach_recursive_mnt() that doesn't\nmatter. The new mount has already reset ->overmount of the old parent by\nthe time the old top mount is moved onto it.\n\nIt matters for reparent() though. propagate_umount() moves a surviving\novermount onto the first ancestor that isn't going to be unmounted. The\nmount it was taken from is unmounted immediately afterwards. If a file\ndescriptor keeps that unmounted mount alive ->overmount points at the\nmoved mount. That's a dangling pointer and UAF as the moved mount is\nunmounted and freed.\n\ndo_lock_mount() follows ->overmount from the target path under\nmount_lock. With a file descriptor on such a mount as the target of a\nmount beneath topmost_overmount() walks into the freed mount and\ndo_lock_mount() takes references on whatever it finds there.\n\nSo reset ->overmount of the old parent in mnt_change_mountpoint() the\nsame way __umount_mnt() does. A mount's ->overmount is then always a\nmount that is attached to it."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"ffdc52fbbd5835a936ad683c943d6d103a2d4514","status":"affected","lessThan":"5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5","versionType":"git"},{"version":"ffdc52fbbd5835a936ad683c943d6d103a2d4514","status":"affected","lessThan":"08d575ee89393fd812dbdca7b5d7b4574cd5a564","versionType":"git"},{"version":"ffdc52fbbd5835a936ad683c943d6d103a2d4514","status":"affected","lessThan":"476ef286a7a5db8bda51325dc0c45887b4d99d9a","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/namespace.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.17","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.17","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.11","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/namespace.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5"},{"url":"https://git.kernel.org/stable/c/08d575ee89393fd812dbdca7b5d7b4574cd5a564"},{"url":"https://git.kernel.org/stable/c/476ef286a7a5db8bda51325dc0c45887b4d99d9a"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Local umount2() reaches do_umount()->umount_tree()->propagate_umount()->reparent()->mnt_change_mountpoint(), and local move_mount(MOVE_MOUNT_BENEATH) later consumes the dangling overmount; no network or physical input reaches this path.\nAC:L - The regression test deterministically creates the propagation topology, pins X_b, frees its reparented overmount, and triggers the UAF; no race or external state is required, and any mount-cache grooming is attacker-controlled.\nPR:L - can_umount() and move_mount() require may_mount(), but the test's unshare(CLONE_NEWUSER|CLONE_NEWNS) gives an ordinary local user CAP_SYS_ADMIN in the child mount namespace, satisfying every mount-operation gate without init-namespace root.\nUI:N - The attacker personally creates the shared/private tmpfs mounts, opens the O_PATH descriptor, performs both lazy unmounts, and invokes move_mount(); no victim must mount, open, or otherwise act on anything.\nS:U - The dangling struct mount created by mnt_change_mountpoint() corrupts the same host kernel that enforces the attacker's mount namespace; this is ordinary kernel privilege escalation, not a VM, hypervisor, or IOMMU boundary crossing.\nC:H - topmost_overmount() reads freed struct mount contents, and where_to_mount() then consumes its stale overmount, mnt_mountpoint, and mnt_parent pointers; reclaiming the mnt_cache object permits redirected kernel-memory accesses and high-impact disclosure.\nI:H - do_lock_mount() calls mntget() and dget() through the freed mount-derived pointers, causing reference-count writes through stale mnt_pcp and dentry state; mount-cache reclamation and heap grooming can turn these UAF writes into control-flow corruption.\nA:H - Following the freed overmount and then dereferencing or locking the stale dentry->d_inode can produce a kernel UAF oops or panic, and the complete mount/unmount/move_mount sequence is repeatable by the same unprivileged process."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-24T14:09:55.095Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.2.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}