Linux kernel: Pseudo dentry can become mount root (race condition)
Summary
In the Linux kernel, a pseudo dentry created for pipes, sockets and similar files can become the root of a bind mount, for example through /proc/self/fd/<fd> of a BPF token file. A concurrent path walk can then access a dentry that is freed too early, which can lead to a memory safety failure. An attacker with local access and low privileges can potentially crash the system or gain higher privileges; the official CVSS score is 7.8 (High).
Affected
- Linux kernel from 6.9 up to, but not including, 6.12.113, 6.18.57 and 7.2.11 (per CVE record and OSV)
- Mainline and other kernel branches must be checked against the referenced kernel.org stable commits
- Distribution kernels may carry backports; check your vendor's advisory
Fixed in
- Linux kernel 6.12.113
- Linux kernel 6.18.57
- Linux kernel 7.2.11
- Fixed commits: 00287afa7cd989efdbf5822b7efac33cce7d489a, 7e1c466011ba9e64d43075396badc03191bcee44, a256e31e0c54c4c37d2523aa52faabdcdd2ebc07, b138e16fb1e81376cea89f727dda7bfccd140de4
Workaround
- No vendor workaround documented.
- Restrict who can create mounts or use BPF tokens on multi-user hosts until the kernel is patched.
Exploitation
- No known exploitation in the wild at the time of research (as of 1 November 2026).
- No public proof-of-concept known at the time of research.
Our recommendation
- Check whether your distribution kernel contains the fix and install the vendor update in the next maintenance window.
- Prioritise shared Linux hosts, CI runners and servers where untrusted local users or code can run.
- Limit mount and BPF token privileges on multi-user systems until patched.
- Reboot after the kernel update so that the fixed kernel is active.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- kernel.org stable commit 00287afa7cd989efdbf5822b7efac33cce7d489a git.kernel.org
- kernel.org stable commit 7e1c466011ba9e64d43075396badc03191bcee44 git.kernel.org
- kernel.org stable commit a256e31e0c54c4c37d2523aa52faabdcdd2ebc07 git.kernel.org
- kernel.org stable commit b138e16fb1e81376cea89f727dda7bfccd140de4 git.kernel.org
- Ubuntu security notice CVE-2026-98982 ubuntu.com
- OSV entry via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:35.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloc_pseudo() hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHE_NORCU and dentry_free() frees them right away because no lockless path walk can ever reach them. That holds as long as such a dentry isn't the root of a mount. But bind mounting /proc/self/fd/<fd> of such a file does exactly that. Most callers of alloc_file_pseudo() put their files on kernel-internal mounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It places the token file on the bpffs mount the caller handed it and that mount is in the caller's mount namespace so the clone goes through: mount --bind /proc/self/fd/<token> <file> open_tree(tokfd, "", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount() __follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq and d_flags of the dentry and only then checks mount_lock. The dentry can be gone by then. The final mntput() of an unmounted parent unhooks a child that stayed attached to it under mount_lock alone. When the child's holder does the final put right after that the root is dput() and freed immediately while a walker that found the mount hashed still looks at it. Refuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing sensible can be done with a bind mount of a bpf token anyway.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.