Linux Kernel: Use-after-free in mount namespace overmount handling
Summary
A flaw in the Linux kernel mount subsystem leaves a stale overmount pointer when a mount is moved to a new parent. A local user with low privileges, for example on a shared host or inside a container, can trigger a use-after-free through mount operations. The CNA rates the impact as high for confidentiality, integrity and availability (CVSS 3.1: 7.8). No user interaction is required, but an attacker needs a local account.
Affected
- Linux kernel 6.17 branch
- Linux kernel 6.18 before 6.18.57
- Linux kernel 6.19 branch until the fixed release (version unknown)
- Exact affected ranges differ between the CNA data, OSV and distribution records; verify against the kernel.org commits.
Fixed in
- Linux kernel 6.18.57 and 7.2.11 (per OSV)
- Upstream commits 08d575ee89393fd812dbdca7b5d7b4574cd5a564, 476ef286a7a5db8bda51325dc0c45887b4d99d9a and 5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5
- Distribution fixed packages: Unknown.
Workaround
- Unknown. No vendor workaround found.
- Restricting unprivileged user namespaces may reduce exposure. This is untested and not verified to block the vulnerable path.
Exploitation
- No exploitation in the wild reported.
- No public proof of concept found.
- EPSS: 0.00161 (very low).
Our recommendation
- Check kernel versions on all Linux hosts and apply the distribution kernel update once published.
- Prioritise multi-user, container, CI runner and jump hosts.
- Watch the Ubuntu, Red Hat, SUSE and Debian trackers for fixed packages.
- Single-tenant servers and workstations: include the fix in the normal kernel update cycle.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Upstream commit 08d575ee89393fd812dbdca7b5d7b4574cd5a564 git.kernel.org
- Upstream commit 476ef286a7a5db8bda51325dc0c45887b4d99d9a git.kernel.org
- Upstream commit 5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5 git.kernel.org
- NVD entry CVE-2026-98995 vulners.com
- Ubuntu security notice CVE-2026-98995 ubuntu.com
- SUSE CVE entry CVE-2026-98995 vulners.com
- OSV Alpaquita entry BELL-CVE-2026-98995 osv.dev
- Linux kernel mount vfs pull request 2720 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:34.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's ->overmount in mnt_change_mountpoint() __umount_mnt() resets ->overmount of the parent when it unmounts the mount that overmounts it. mnt_change_mountpoint() doesn't. It moves the mount to its new parent and leaves the old one pointing at it. For a mount that is moved beneath in attach_recursive_mnt() that doesn't matter. The new mount has already reset ->overmount of the old parent by the time the old top mount is moved onto it. It matters for reparent() though. propagate_umount() moves a surviving overmount onto the first ancestor that isn't going to be unmounted. The mount it was taken from is unmounted immediately afterwards. If a file descriptor keeps that unmounted mount alive ->overmount points at the moved mount. That's a dangling pointer and UAF as the moved mount is unmounted and freed. do_lock_mount() follows ->overmount from the target path under mount_lock. With a file descriptor on such a mount as the target of a mount beneath topmost_overmount() walks into the freed mount and do_lock_mount() takes references on whatever it finds there. So reset ->overmount of the old parent in mnt_change_mountpoint() the same way __umount_mnt() does. A mount's ->overmount is then always a mount that is attached to it.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.