All vulnerabilities
CVE-2026-99172

Linux: ipc: drop the mqueue mount with kern_unmount() on setup failure

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

In the Linux kernel, the following vulnerability has been resolved:

ipc: drop the mqueue mount with kern_unmount() on setup failure

mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its ->mnt_ns is MNT_NS_INTERNAL. When setting up the mqueue or ipc sysctls or msg_init_ns() fails afterwards, create_ipc_ns() drops it with a plain mntput(). With ->mnt_ns set that takes the fast path of mntput_no_expire(). The count drops to zero and nothing ever kills the mount, so the mount and the mqueue superblock are leaked.

Commit dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace") added the first failure path after mq_init_ns() and never dropped the mount. Commit 7229d74e5e8c ("ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure") tried to fix that with a mntput() but that doesn't help for a long-term mount.

Use kern_unmount(). free_ipc() open-codes the same thing for a namespace that made it.

Text from CVE List

Affected versions 6

  • Linuxaffected: dc55e35f9e810f23dd69cfdc91a3d636023f57a2 before c0620b648321fff654173d238d4a85298ea16d05CVE List
  • Linuxaffected: dc55e35f9e810f23dd69cfdc91a3d636023f57a2 before f0e48172a59e517e613b73f73cc35f24fd123aebCVE List
  • Linuxaffected: 5.19CVE List
  • Linuxunaffected: all versions before 5.19CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2