Към съдържанието
Търсене

CVE-2026-98993: Linux

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNT_UMOUNT in clone_mnt() MNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() has taken out of its namespace. It's never cleared. __detach_mounts() unhooks a mount that carries it instead of unmounting it. disconnect_mount() lets an unmounted child stay attached only if its parent carries it. propagate_umount() takes it as the sign that a mount is going to be unmounted when it decides what else can be unmounted, where a chain of locked mounts ends and where a for reparenting an overmount. clone_mnt() copies the flags of the source and only masks MNT_INTERNAL_FLAGS which doesn't include MNT_UMOUNT. A mount that was lazily unmounted but is kept alive by a file descriptor can still be copied when its root is an nsfs or pidfs file because may_copy_tree() accepts those before checking whether the source is mounted at all: mount --bind /proc/self/ns/net /tmp/x exec 3< /tmp/x umount -l /tmp/x mount --bind /proc/self/fd/3 /tmp/y The mount on /tmp/y is attached to the caller's namespace with MNT_UMOUNT already set and every copy of it inherits the flag again. That causes a number of bugs: - Unlink its mountpoint from a mount namespace where it isn't one. __detach_mounts() takes it for a mount that was unmounted earlier, unhooks it from its parent and drops the reference the namespace holds on it. It stays in the namespace with one reference too few and as its own parent, so it can't be unmounted through the file descriptor anymore and the namespace never finds it again. When the namespace goes away it's leaked and points to a freed struct mnt_namespace that may_change_propagation() and anon_ns_root() read on the next propagation change or mount_setattr() through the file descriptor. - Make it shared and unmount a peer. trace_transfers() follows the flag from the peer into it and strips it from its peer group. - Let a propagated u

    Засегнати продукти

    • Linux Linux: 590ce4bcbfb4e0462a720a4ad901e84416080bba преди b201d59d047a5e05728c10864a56bdb67950d0b1; 590ce4bcbfb4e0462a720a4ad901e84416080bba преди de098fb4594f8724fa286f08c7f42837bc19b478; 590ce4bcbfb4e0462a720a4ad901e84416080bba преди fc1f3a476c35164c1beed7090fc0e630f52d778e; 590ce4bcbfb4e0462a720a4ad901e84416080bba преди 99698cfa34e493fc091219056aae446fe9442a96; 590ce4bcbfb4e0462a720a4ad901e84416080bba преди c26c1a91ad2881a194f7af543e0b57f0870006b2; 590ce4bcbfb4e0462a720a4ad901e84416080bba преди eecc9cd0fc07dba3f7fb0b2f844b4029435a2f7b; 590ce4bcbfb4e0462a720a4ad901e84416080bba преди 5077b52e9e4d72da53c50251296b99cd416765a1; 590ce4bcbfb4e0462a720a4ad901e84416080bba преди e2c6d326216642011da318b9edfd5d57ebd5a56f; 7052e71b2d085f76800115d4a212dcaf82b86262; 4.0.2 преди 4.1
    • Linux Linux: 4.1; преди 4.1; 5.10.273 до 5.10.*; 5.15.224 до 5.15.*; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.2.11 до 7.2.*; от 7.3 нататък

    История

    • 23 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98993: Linux | freedomonline.bg