{"schema":"threatline.record/2","record":{"id":"CVE-2026-97971","aliases":[],"summary":"nstree: check listing permission before taking a namespace reference","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnstree: check listing permission before taking a namespace reference\n\nlegitimize_ns() takes a reference on the candidate namespace before\nmay_list_ns() has decided whether the caller may see it. The\n__free(ns_put) cleanup on the denied path can drop the last reference to a\nmount namespace while we still hold the rcu read lock, and put_mnt_ns()\nmay sleep there. This is the same problem commit 2ec2aff3c8e2 (\"ns: make\nsure reference are dropped outside of rcu lock\") fixed for the put_user()\npath. Neither ns_requested() nor may_list_ns() needs a reference, both\nonly look at the namespace type and at the caller's own namespaces, so do\nthe checks first and take the reference last.\n\nSplat:\n\n  Voluntary context switch within RCU read-side critical section!\n  WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0x238/0x2a0, CPU#5: a/3442\n  CPU: 5 UID: 1000 PID: 3442 Comm: a Not tainted 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy)\n  RIP: 0010:rcu_note_context_switch+0x238/0x2a0\n  Call Trace:\n   <TASK>\n   __schedule+0xcf/0x650\n   schedule+0x27/0x90\n   schedule_preempt_disabled+0x15/0x30\n   __mutex_lock.constprop.0+0x550/0xaf0\n   __mutex_lock_slowpath+0x13/0x20\n   mutex_lock+0x3b/0x50\n   exp_funnel_lock+0xb2/0x260\n   synchronize_rcu_expedited+0xe7/0x220\n   namespace_unlock+0x26a/0x320\n   put_mnt_ns+0xd3/0x120\n   mntns_put+0xe/0x20\n   do_listns+0x13e/0x560\n   __do_sys_listns+0x126/0x2d0\n   __x64_sys_listns+0x20/0x30\n   x64_sys_call+0x2366/0x2390\n   do_syscall_64+0x105/0x5a0\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   </TASK>","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97971","source_modified_at":"2026-10-19T09:11:37.164Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"76b6f5dfb3fda76fce1f9990d6fa58adc711122b","lessThan":"9e673bf5d88aa898e52cef5c87058c3fa845bc71","status":"affected","versionType":"git"},{"version":"76b6f5dfb3fda76fce1f9990d6fa58adc711122b","lessThan":"56ea4e86832d8abe8930394473566c194d189f85","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97971","source_modified_at":"2026-10-19T09:11:37.164Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97971","source_modified_at":"2026-10-19T09:11:37.164Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"9e673bf5d88aa898e52cef5c87058c3fa845bc71","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97971","source_modified_at":"2026-10-19T09:11:37.164Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"56ea4e86832d8abe8930394473566c194d189f85","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0012,"percentile":0.01748,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:23:11.539Z","modified_at":"2026-10-19T09:11:37.164Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97971","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:11:37.164Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97971","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/9e673bf5d88aa898e52cef5c87058c3fa845bc71"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/56ea4e86832d8abe8930394473566c194d189f85"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:11:37.164Z","content_hash":"e1e6ec8e8c0a0c05d882cd6dab95d85f4fc7d3ba37b4a991c9c3f7abdb93c723"}}