Linux kernel: Locked mount can be expired, revealing hidden files
Summary
A flaw in the Linux kernel's mount handling lets a local user with low privileges reveal files and directories that a locked mount is meant to hide. A mount can become locked when a user namespace owner moves it beneath a locked mount, and the kernel then allows the lower mount to be expired first. Exploitation requires local code execution, so the risk is mainly on shared Linux, container and CI hosts.
Affected
- Linux kernel from commit 5ff9d8a65ce8 up to the fix commits (CNA range)
- Per OSV: introduced in 3.12.0, fixed in 6.18.57 and 7.2.11
- Unknown: exact affected versions in distribution kernels; the CNA entry for 3.12 could not be verified
Fixed in
- Linux kernel 6.18.57 and 7.2.11 (stable branches, per OSV and CNA)
- Unknown: fixed mainline version and distribution kernel versions; check your distribution advisory
- Confirm that the patched kernel also includes the follow-up fix for CVE-2026-99170
Workaround
- Unknown: no vendor workaround found; the fix is a kernel update
- Interim option: restrict unprivileged user namespaces where workloads allow it; test first, as browsers and containers may depend on them
Exploitation
- No evidence of exploitation in the wild found at the time of research
- No public proof of concept found; no KEV listing found
- EPSS 0.0017 at last listing
Our recommendation
- Inventory Linux hosts by distribution and kernel version
- Apply the distribution kernel update once released and confirm it includes the follow-up fix
- Prioritise multi-user, container and CI hosts
- Monitor vendor advisories for corrected fixed versions
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Kernel stable commit 6b8dc3713a76 git.kernel.org
- Kernel stable commit d23265a12e49 git.kernel.org
- Kernel stable commit f78ddcc87224 git.kernel.org
- Ubuntu CVE tracker ubuntu.com
- OSV advisory (Vulners) vulners.com
- NVD record (Vulners) vulners.com
- Strix CVE-2026-98978 analysis www.strix.ai
- Strix CVE-2026-99170 follow-up www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:07.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. do_umount() refuses to unmount locked mounts but shrink_submounts() doesn't. A shrinkable mount can become locked once the owner of a user namespace puts it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked property now moves to the mount at the bottom making it possible to unmount the top mount. So umount() of an unlocked ancestor now expires the bottom mount first and the covered directory is revealed: move_mount(c -> x/hidden, MOVE_MOUNT_BENEATH) = 0 the cover after the lock moved: umount2(x/hidden) = 0 the holder of the lock: umount2(x/hidden) = EINVAL the root of the copy, busy: umount2(x) = EBUSY reads x/hidden/secret: "covered-by-root" So leave a locked mount alone as it dies together with its parent. A plain umount() of an unlocked mount with a locked one below it is EBUSY from now on. It's the same for any other locked child. A lazy umount still takes the whole tree. mark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree() leaves a mount on an expiry list alone and nothing else puts a locked one on such a list. Add an assert for this.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.