CVE-2026-98987: namespace: look at the topmost mount for a mount namespace file

CVE-2026-98987: namespace: look at the topmost mount for a mount namespace file

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

namespace: look at the topmost mount for a mount namespace file

attach_recursive_mnt() preallocates a mountpoint for the root of the
topmost mount of the source so that a mount that already sits at the
destination can be put on top of the source or on top of one of its
propagated copies.

The copies are made without CL_COPY_MNT_NS_FILE so their chain of
overmounts is shorter than the source's. It ends below the first bind
mount of a mount namespace file. So while the loop walks up the chain of
the source it remembers the mountpoint of that mount in "shorter" and
the existing mount is put there for the copies.

But the loop ends at the topmost mount without ever looking at it. If
the topmost mount is the only mount namespace file in the chain
"shorter" stays NULL and mnt_change_mountpoint() attaches the existing
mount of the copy below the root of the mount namespace file. That's a
dentry of nsfs. No path walk in the copy's mount namespace ever gets
there. The mount is gone until its parent goes and the copy that took
its place can't be unmounted synchronously because it has a child:

  S      bind mount of a file
  N      bind mount of a mount namespace file on top of S
  A      shared mount, B a slave of A, Q mounted on B/file

  move_mount(S, A/file)
  cat B/file          -> the content of S instead of Q
  umount B/file       -> EBUSY

Look at every mount of the chain including the topmost one.

The Linux kernel CVE team has assigned CVE-2026-98987 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.17 with commit 96f5d2e051653f2cfe9137c5d3c7794c358ffb03 and fixed in 6.18.57 with commit b9c40553f6ceba50042281eef6f701e5fb719726
	Issue introduced in 6.17 with commit 96f5d2e051653f2cfe9137c5d3c7794c358ffb03 and fixed in 7.2.11 with commit 87ecd4c6da146363384a603bd9e90c90e7275536
	Issue introduced in 6.17 with commit 96f5d2e051653f2cfe9137c5d3c7794c358ffb03 and fixed in 7.3 with commit 8714b44adac7b10506e1db3ef1710689751f0f10

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98987
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/namespace.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b9c40553f6ceba50042281eef6f701e5fb719726
	https://git.kernel.org/stable/c/87ecd4c6da146363384a603bd9e90c90e7275536
	https://git.kernel.org/stable/c/8714b44adac7b10506e1db3ef1710689751f0f10