{"schema":"threatline.record/2","record":{"id":"CVE-2026-98995","aliases":[],"summary":"namespace: reset the old parent's ->overmount in mnt_change_mountpoint()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: reset the old parent's ->overmount in mnt_change_mountpoint()\n\n__umount_mnt() resets ->overmount of the parent when it unmounts the\nmount that overmounts it. mnt_change_mountpoint() doesn't. It moves the\nmount to its new parent and leaves the old one pointing at it.\n\nFor a mount that is moved beneath in attach_recursive_mnt() that doesn't\nmatter. The new mount has already reset ->overmount of the old parent by\nthe time the old top mount is moved onto it.\n\nIt matters for reparent() though. propagate_umount() moves a surviving\novermount onto the first ancestor that isn't going to be unmounted. The\nmount it was taken from is unmounted immediately afterwards. If a file\ndescriptor keeps that unmounted mount alive ->overmount points at the\nmoved mount. That's a dangling pointer and UAF as the moved mount is\nunmounted and freed.\n\ndo_lock_mount() follows ->overmount from the target path under\nmount_lock. With a file descriptor on such a mount as the target of a\nmount beneath topmost_overmount() walks into the freed mount and\ndo_lock_mount() takes references on whatever it finds there.\n\nSo reset ->overmount of the old parent in mnt_change_mountpoint() the\nsame way __umount_mnt() does. A mount's ->overmount is then always a\nmount that is attached to it.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98995","source_modified_at":"2026-10-23T12:20:14.155Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"ffdc52fbbd5835a936ad683c943d6d103a2d4514","lessThan":"5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5","status":"affected","versionType":"git"},{"version":"ffdc52fbbd5835a936ad683c943d6d103a2d4514","lessThan":"08d575ee89393fd812dbdca7b5d7b4574cd5a564","status":"affected","versionType":"git"},{"version":"ffdc52fbbd5835a936ad683c943d6d103a2d4514","lessThan":"476ef286a7a5db8bda51325dc0c45887b4d99d9a","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98995","source_modified_at":"2026-10-23T12:20:14.155Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","status":"unaffected","versionType":"semver"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.11","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98995","source_modified_at":"2026-10-23T12:20:14.155Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98995","source_modified_at":"2026-10-23T12:20:14.155Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"08d575ee89393fd812dbdca7b5d7b4574cd5a564","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98995","source_modified_at":"2026-10-23T12:20:14.155Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"476ef286a7a5db8bda51325dc0c45887b4d99d9a","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T12:20:14.155Z","modified_at":"2026-10-23T12:20:14.155Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98995","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T12:20:14.155Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/5e0a1f2c753a79749bc2ead3ae2f2ede3941daa5"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/08d575ee89393fd812dbdca7b5d7b4574cd5a564"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/476ef286a7a5db8bda51325dc0c45887b4d99d9a"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T12:20:14.155Z","content_hash":"3e2e211ae533f1815da0a572925c4b4ab6166729d20002e62cc6a78a5525691c"}}