All vulnerabilities
CVE-2026-98983

Linux: unshare: don't drop active namespace references that were never taken

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in56fe03a0c05dba4c5f6a23c391f96de1614a098cAlso 0b6f31a3c0b16066f812e94b52a704174a6f23cd, 5.16 and 5 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

Show all 8 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

unshare: don't drop active namespace references that were never taken

Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy().

But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using:

WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare

Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid.

Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.

Text from CVE List

Affected versions 18

  • Linuxaffected: a98621a0f187a934c115dcfe79a49520ae892111 before 56fe03a0c05dba4c5f6a23c391f96de1614a098cCVE List
  • Linuxaffected: a98621a0f187a934c115dcfe79a49520ae892111 before 0b6f31a3c0b16066f812e94b52a704174a6f23cdCVE List
  • Linuxaffected: 27ae6b17c9ba7ff353ab0906297f08aa845782b4CVE List
  • Linuxaffected: 297261b343371c4f0b31055d53d285138ec21565CVE List
  • Linuxaffected: 813a47b0309097da71781ee4ac11922e39b67d55CVE List
  • Linuxaffected: 6e608e3e5ce12ce7fd21e46212eccca37f917d0eCVE List
  • Linuxaffected: a261fccdb4ac58ec5ba6aa1d92a6cc418fff301fCVE List
  • Linuxaffected: 665dc1ed16357988d439fc5bbc860ee36f540d81CVE List
  • Linuxaffected: 5.15.209 before 5.16CVE List
  • Linuxaffected: 6.1.175 before 6.2CVE List
  • Linuxaffected: 6.6.141 before 6.7CVE List
  • Linuxaffected: 6.12.91 before 6.13CVE List
  • Linuxaffected: 6.18.33 before 6.19CVE List
  • Linuxaffected: 7.0.10 before 7.1CVE List
  • Linuxaffected: 7.1CVE List
  • Linuxunaffected: all versions before 7.1CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2