Към съдържанието
Търсене

CVE-2026-98996: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those functions from propagation hell. It skips a copy that has child mounts except for the case of a single child mount covering the copy's root. That algorithm used to be exact. It isn't anymore. Originally only childless copies were unmounted during propagation. And 1064f874abc0 ("mnt: Tuck mounts under others instead of creating shadow/side mounts.") ended up adding covered mounts to both sides in one go. Along came 99b19d16471e ("mnt: In propgate_umount handle visiting mounts in any order") and that started to unmount more than before: [1]: A copy of a mount is unmounted when each of its children is either its overmount or a copy of the victim itself. In the former case the overmount gets reparented. In the latter case the copy of the victim will end up being unmounted. So propagate_umount() ended up being rewritten without adjusting propagate_mount_busy(). And currently propagate_mount_busy() doesn't look at copies of the victim that have two or more children nor a single child that is not the overmount. So any such copy in [1] is not checked for references. The result is that a synchronous unmount succeeds, pulling out a mount that is still in use. A container can run into this with its own mounts. The host shares a tree with the container and the host has a mount in that tree: mount -t tmpfs none /mnt mount --make-shared /mnt mount -t tmpfs none /mnt/a The container's /mnt is a slave copy of the host mount. The container now takes a detached copy of the tree and mounts that copy beneath its propagated copy of /mnt/a and keeps the file descriptor to the tree open: unshare -m --propagation unchanged mount --make-rslave / fd = open_tree

    Засегнати продукти

    • Linux Linux: 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 преди bf2c8dec26fb792876b5e9bde7030c45d8be3908; 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 преди a210ac218c307513d43e98a08f23c2dfbeeebc2f; 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 преди 6857e209015f95be7a8f19a9cd5dac345b9b9859; dc5ce95b0252d143497283f7f659840d4f8a79d0; fdb8f10499924d96b8eb60cc1354b278f6fcf0e9; bb4fbf094b440a9209ed88c8681960d4b26eec0f; b43f81ef0babcc07db1eaaece37c989204e4ff00; 81311d1698c0c87c972ba71d3ce44a617b52ea21; 4.1.43 преди 4.2; 4.4.78 преди 4.5; 4.9.39 преди 4.10; 4.11.12 преди 4.12; 4.12.3 преди 4.13
    • Linux Linux: 4.13; преди 4.13; 6.18.57 до 6.18.*; 7.2.11 до 7.2.*; от 7.3 нататък

    История

    • 23 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98996: Linux | freedomonline.bg