CVE-2026-98989
CVE-2026-98989 · namespace: check a recursive bind mount for mount namespace loops
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_loopback() refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file, or of an ancestor's, would cause a cycle. But it only checks the dentry the bind mount starts from. With MS_REC everything below it is copied and do_loopback() passes CL_COPY_MNT_NS_FILE so mount namespace files below the source are copied. That's fine for a source in the caller's own mount namespace. Every mount namespace file in there passed the same check when it was bind-mounted. It isn't fine for a source in another mount namespace. may_copy_tree() accepts a bind mount of any nsfs or pidfs file no matter what mount namespace it lives in so that /proc/<pid>/ns/<ns> and pidfds can be bind mounted. If we create a bind-mount stack of mount namespaces file descriptors the kernel will copy them irrespective of their ancestoral relationship to the mount namespace in question: 151 146 0:7 net:[4026531833] /tmp/nrc/y rw - nsfs nsfs rw 152 151 0:7 mnt:[4026532293] /tmp/nrc/y rw - nsfs nsfs rw Mount 152 is a mount of the mount namespace file of mount namespace 4026532293 inside mount namespace 4026532293. That namespace and every mount in it are leaked... All it takes is a process in an older mount namespace that stacks the file and repeating it leaks without limit: after control: Shmem: 380 kB child: mount(/proc/self/fd/6, MS_BIND|MS_REC): ok after cycle: Shmem: 65916 kB do_move_mount() runs check_for_nsfs_mounts() over a detached tree for exactly that reason. Do the same for the copy before it is grafted.
EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
linux
- Versions
- ≥ e149ed2b805fefdccf7ccdfc19eca22fdd4514ac, < a0ba48256f5dff6f75a45f8ce39fe57f21df1022: Affected (git)
- ≥ e149ed2b805fefdccf7ccdfc19eca22fdd4514ac, < 37a82f400efa4d263542a5fa41755b21057f1e5d: Affected (git)
- ≥ e149ed2b805fefdccf7ccdfc19eca22fdd4514ac, < c640a01a78e42302879006ed7b7d5a9a943ba815: Affected (git)
Update to 37a82f400efa4d263542a5fa41755b21057f1e5d
linux
- Versions
- 3.19: Affected
- ≥ 0, < 3.19: Not affected (semver)
- ≥ 6.18.57, ≤ 6.18.*: Not affected (semver)
- ≥ 7.2.11, ≤ 7.2.*: Not affected (semver)
- ≥ 7.3: Not affected (original_commit_for_fix)
No fix published
linux Debian:12
- Versions
- 6.1.106-1
- 6.1.106-2
- 6.1.106-3
- 6.1.112-1
- 6.1.115-1
- 6.1.119-1
- 6.1.123-1
- 6.1.124-1
- 6.1.128-1
- 6.1.129-1
- 6.1.133-1
- 6.1.135-1
- 6.1.137-1
- 6.1.139-1
- 6.1.140-1
- 6.1.147-1
- 6.1.148-1
- 6.1.153-1
- 6.1.158-1
- 6.1.159-1
- 6.1.162-1
- 6.1.164-1
- 6.1.170-1
- 6.1.170-2
- 6.1.170-3
- 6.1.172-1
- 6.1.174-1
- 6.1.176-1
- 6.1.177-1
- 6.1.180-1
- 6.1.187-1
- 6.1.190-1
- 6.1.27-1
- 6.1.37-1
- 6.1.38-1
- 6.1.38-2
- 6.1.38-2~bpo11+1
- 6.1.38-3
- 6.1.38-4
- 6.1.38-4~bpo11+1
- 6.1.52-1
- 6.1.55-1
- 6.1.55-1~bpo11+1
- 6.1.64-1
- 6.1.66-1
- 6.1.67-1
- 6.1.69-1
- 6.1.69-1~bpo11+1
- 6.1.76-1
- 6.1.76-1~bpo11+1
- 6.1.82-1
- 6.1.85-1
- 6.1.90-1
- 6.1.90-1~bpo11+1
- 6.1.94-1
- 6.1.94-1~bpo11+1
- 6.1.98-1
- 6.1.99-1
- 6.10-1~exp1
- 6.10.1-1~exp1
- 6.10.11-1
- 6.10.11-1~bpo12+1
- 6.10.12-1
- 6.10.3-1
- 6.10.4-1
- 6.10.6-1
- 6.10.6-1~bpo12+1
- 6.10.7-1
- 6.10.9-1
- 6.11-1~exp1
- 6.11.10-1
- 6.11.10-1~bpo12+1
- 6.11.2-1
- 6.11.4-1
- 6.11.5-1
- 6.11.5-1~bpo12+1
- 6.11.6-1
- 6.11.7-1
- 6.11.9-1
- 6.11~rc4-1~exp1
- 6.11~rc5-1~exp1
- 6.12.10-1
- 6.12.100-1
- 6.12.101-1
- 6.12.105-1
- 6.12.107-1
- 6.12.11-1
- 6.12.11-1+alpha
- 6.12.11-1+alpha.1
- 6.12.111-1
- 6.12.113-1
- 6.12.12-1
- 6.12.12-1~bpo12+1
- 6.12.13-1
- 6.12.15-1
- 6.12.16-1
- 6.12.17-1
- 6.12.19-1
- 6.12.20-1
- 6.12.21-1
- 6.12.22-1
- 6.12.22-1~bpo12+1
- 6.12.25-1
- 6.12.27-1
- 6.12.27-1~bpo12+1
- 6.12.29-1
- 6.12.3-1
- 6.12.30-1
- 6.12.30-1~bpo12+1
- 6.12.31-1
- 6.12.32-1
- 6.12.32-1~bpo12+1
- 6.12.33-1
- 6.12.33-1~bpo12+1
- 6.12.35-1
- 6.12.35-1~bpo12+1
- 6.12.37-1
- 6.12.38-1
- 6.12.38-1~bpo12+1
- 6.12.41-1
- 6.12.43-1
- 6.12.43-1~bpo12+1
- 6.12.48-1
- 6.12.5-1
- 6.12.57-1
- 6.12.57-1~bpo12+1
- 6.12.6-1
- 6.12.63-1
- 6.12.63-1~bpo12+1
- 6.12.69-1
- 6.12.69-1~bpo12+1
- 6.12.73-1
- 6.12.73-1~bpo12+1
- 6.12.74-1
- 6.12.74-2
- 6.12.74-2~bpo12+1
- 6.12.8-1
- 6.12.85-1
- 6.12.85-1~bpo12+1
- 6.12.86-1
- 6.12.86-1~bpo12+1
- 6.12.88-1
- 6.12.88-1~bpo12+1
- 6.12.9-1
- 6.12.9-1+alpha
- 6.12.9-1~bpo12+1
- 6.12.90-1
- 6.12.90-1~bpo12+1
- 6.12.90-2
- 6.12.90-2~bpo12+1
- 6.12.94-1
- 6.12.94-1~bpo12+1
- 6.12.95-1
- 6.12.95-1~bpo12+1
- 6.12.96-1
- 6.12~rc6-1~exp1
- 6.13.10-1~exp1
- 6.13.11-1~exp1
- 6.13.2-1~exp1
- 6.13.3-1~exp1
- 6.13.4-1~exp1
- 6.13.5-1~exp1
- 6.13.6-1~exp1
- 6.13.7-1~exp1
- 6.13.8-1~exp1
- 6.13.9-1~exp1
- 6.13~rc6-1~exp1
- 6.13~rc7-1~exp1
- 6.14.3-1~exp1
- 6.14.5-1~exp1
- 6.14.6-1~exp1
- 6.15-1~exp1
- 6.15.1-1~exp1
- 6.15.2-1~exp1
- 6.15.3-1~exp1
- 6.15.4-1~exp1
- 6.15.5-1~exp1
- 6.15.6-1~exp1
- 6.15~rc7-1~exp1
- 6.16-1~exp1
- 6.16.1-1~exp1
- 6.16.10-1
- 6.16.11-1
- 6.16.12-1
- 6.16.12-1~bpo13+1
- 6.16.12-2
- 6.16.3-1
- 6.16.3-1~bpo13+1
- 6.16.5-1
- 6.16.6-1
- 6.16.7-1
- 6.16.8-1
- 6.16.9-1
- 6.16~rc7-1~exp1
- 6.17.10-1
- 6.17.11-1
- 6.17.12-1
- 6.17.13-1
- 6.17.13-1~bpo13+1
- 6.17.2-1~exp1
- 6.17.5-1~exp1
- 6.17.6-1
- 6.17.7-1
- 6.17.7-2
- 6.17.8-1
- 6.17.8-1~bpo13+1
- 6.17.9-1
- 6.18.1-1~exp1
- 6.18.10-1
- 6.18.12-1
- 6.18.12-1~bpo13+1
- 6.18.13-1
- 6.18.14-1
- 6.18.15-1
- 6.18.15-1~bpo13+1
- 6.18.2-1~exp1
- 6.18.3-1
- 6.18.5-1
- 6.18.5-1~bpo13+1
- 6.18.8-1
- 6.18.9-1
- 6.18.9-1~bpo13+1
- 6.18~rc4-1~exp1
- 6.18~rc4-1~exp2
- 6.18~rc5-1~exp1
- 6.18~rc6-1~exp1
- 6.18~rc7-1~exp1
- 6.19-1~exp1
- 6.19.10-1
- 6.19.10-1~bpo13+1
- 6.19.11-1
- 6.19.11-1~bpo13+1
- 6.19.12-1
- 6.19.13-1
- 6.19.13-1~bpo13+1
- 6.19.14-1
- 6.19.14-1~bpo13+1
- 6.19.2-1~exp1
- 6.19.3-1~exp1
- 6.19.4-1~exp1
- 6.19.5-1~exp1
- 6.19.6-1
- 6.19.6-2
- 6.19.6-2~bpo13+1
- 6.19.8-1
- 6.19.8-1~bpo13+1
- 6.19~rc4-1~exp1
- 6.19~rc5-1~exp1
- 6.19~rc6-1~exp1
- 6.19~rc7-1~exp1
- 6.19~rc8-1~exp1
- 6.3.1-1~exp1
- 6.3.11-1
- 6.3.2-1~exp1
- 6.3.4-1~exp1
- 6.3.5-1~exp1
- 6.3.7-1
- 6.3.7-1~bpo12+1
- 6.4.1-1~exp1
- 6.4.11-1
- 6.4.13-1
- 6.4.4-1
- 6.4.4-1~bpo12+1
- 6.4.4-2
- 6.4.4-3
- 6.4.4-3~bpo12+1
- 6.4~rc6-1~exp1
- 6.4~rc7-1~exp1
- 6.5.1-1~exp1
- 6.5.10-1
- 6.5.10-1~bpo12+1
- 6.5.13-1
- 6.5.3-1
- 6.5.3-1~bpo12+1
- 6.5.6-1
- 6.5.8-1
- 6.5~rc4-1~exp1
- 6.5~rc6-1~exp1
- 6.5~rc7-1~exp1
- 6.6.11-1
- 6.6.13-1
- 6.6.13-1~bpo12+1
- 6.6.15-1
- 6.6.15-2
- 6.6.3-1~exp1
- 6.6.4-1~exp1
- 6.6.7-1~exp1
- 6.6.8-1
- 6.6.9-1
- 6.7-1~exp1
- 6.7.1-1~exp1
- 6.7.12-1
- 6.7.12-1~bpo12+1
- 6.7.4-1~exp1
- 6.7.7-1
- 6.7.9-1
- 6.7.9-2
- 6.8.11-1
- 6.8.12-1
- 6.8.12-1~bpo12+1
- 6.8.9-1
- 6.9.10-1
- 6.9.10-1~bpo12+1
- 6.9.11-1
- 6.9.12-1
- 6.9.2-1~exp1
- 6.9.7-1
- 6.9.7-1~bpo12+1
- 6.9.8-1
- 6.9.9-1
- 7.0-1~exp1
- 7.0.1-1~exp1
- 7.0.10-1
No fix published
linux Debian:13
- Versions
- 6.12.100-1
- 6.12.101-1
- 6.12.105-1
- 6.12.107-1
- 6.12.111-1
- 6.12.113-1
- 6.12.38-1
- 6.12.41-1
- 6.12.43-1
- 6.12.43-1~bpo12+1
- 6.12.48-1
- 6.12.57-1
- 6.12.57-1~bpo12+1
- 6.12.63-1
- 6.12.63-1~bpo12+1
- 6.12.69-1
- 6.12.69-1~bpo12+1
- 6.12.73-1
- 6.12.73-1~bpo12+1
- 6.12.74-1
- 6.12.74-2
- 6.12.74-2~bpo12+1
- 6.12.85-1
- 6.12.85-1~bpo12+1
- 6.12.86-1
- 6.12.86-1~bpo12+1
- 6.12.88-1
- 6.12.88-1~bpo12+1
- 6.12.90-1
- 6.12.90-1~bpo12+1
- 6.12.90-2
- 6.12.90-2~bpo12+1
- 6.12.94-1
- 6.12.94-1~bpo12+1
- 6.12.95-1
- 6.12.95-1~bpo12+1
- 6.12.96-1
- 6.13.10-1~exp1
- 6.13.11-1~exp1
- 6.13.2-1~exp1
- 6.13.3-1~exp1
- 6.13.4-1~exp1
- 6.13.5-1~exp1
- 6.13.6-1~exp1
- 6.13.7-1~exp1
- 6.13.8-1~exp1
- 6.13.9-1~exp1
- 6.13~rc6-1~exp1
- 6.13~rc7-1~exp1
- 6.14.3-1~exp1
- 6.14.5-1~exp1
- 6.14.6-1~exp1
- 6.15-1~exp1
- 6.15.1-1~exp1
- 6.15.2-1~exp1
- 6.15.3-1~exp1
- 6.15.4-1~exp1
- 6.15.5-1~exp1
- 6.15.6-1~exp1
- 6.15~rc7-1~exp1
- 6.16-1~exp1
- 6.16.1-1~exp1
- 6.16.10-1
- 6.16.11-1
- 6.16.12-1
- 6.16.12-1~bpo13+1
- 6.16.12-2
- 6.16.3-1
- 6.16.3-1~bpo13+1
- 6.16.5-1
- 6.16.6-1
- 6.16.7-1
- 6.16.8-1
- 6.16.9-1
- 6.16~rc7-1~exp1
- 6.17.10-1
- 6.17.11-1
- 6.17.12-1
- 6.17.13-1
- 6.17.13-1~bpo13+1
- 6.17.2-1~exp1
- 6.17.5-1~exp1
- 6.17.6-1
- 6.17.7-1
- 6.17.7-2
- 6.17.8-1
- 6.17.8-1~bpo13+1
- 6.17.9-1
- 6.18.1-1~exp1
- 6.18.10-1
- 6.18.12-1
- 6.18.12-1~bpo13+1
- 6.18.13-1
- 6.18.14-1
- 6.18.15-1
- 6.18.15-1~bpo13+1
- 6.18.2-1~exp1
- 6.18.3-1
- 6.18.5-1
- 6.18.5-1~bpo13+1
- 6.18.8-1
- 6.18.9-1
- 6.18.9-1~bpo13+1
- 6.18~rc4-1~exp1
- 6.18~rc4-1~exp2
- 6.18~rc5-1~exp1
- 6.18~rc6-1~exp1
- 6.18~rc7-1~exp1
- 6.19-1~exp1
- 6.19.10-1
- 6.19.10-1~bpo13+1
- 6.19.11-1
- 6.19.11-1~bpo13+1
- 6.19.12-1
- 6.19.13-1
- 6.19.13-1~bpo13+1
- 6.19.14-1
- 6.19.14-1~bpo13+1
- 6.19.2-1~exp1
- 6.19.3-1~exp1
- 6.19.4-1~exp1
- 6.19.5-1~exp1
- 6.19.6-1
- 6.19.6-2
- 6.19.6-2~bpo13+1
- 6.19.8-1
- 6.19.8-1~bpo13+1
- 6.19~rc4-1~exp1
- 6.19~rc5-1~exp1
- 6.19~rc6-1~exp1
- 6.19~rc7-1~exp1
- 6.19~rc8-1~exp1
- 7.0-1~exp1
- 7.0.1-1~exp1
- 7.0.10-1
- 7.0.10-1~bpo13+1
- 7.0.12-1
- 7.0.12-2
- 7.0.12-2~bpo13+1
- 7.0.13-1
- 7.0.13-1~bpo13+1
- 7.0.14-1
- 7.0.3-1
- 7.0.4-1
- 7.0.4-1~bpo13+1
- 7.0.7-1
- 7.0.7-1~bpo13+1
- 7.0.9-1
- 7.0.9-1~bpo13+1
- 7.1.1-1~exp1
- 7.1.10-1
- 7.1.12-1
- 7.1.13-1
- 7.1.13-1~bpo13+1
- 7.1.2-1~exp1
- 7.1.3-1
- 7.1.3-1+sunvdc
- 7.1.3-1~bpo13+1
- 7.1.4-1
- 7.1.5-1
- 7.1.6-1
- 7.1.7-1
- 7.1.7-1~bpo13+1
- 7.1.8-1
- 7.1.8-1~bpo13+1
- 7.1.8-2
- 7.1.9-1
- 7.1.9-1+sparc64
- 7.1~rc2-1~exp1
- 7.1~rc3-1~exp1
- 7.1~rc4-1~exp1
- 7.1~rc4-1~exp2
- 7.1~rc5-1~exp1
- 7.1~rc7-1~exp1
- 7.2.10-1
- 7.2.11-1
- 7.2.12-1
- 7.2.2-1~exp1
- 7.2.3-1~exp1
- 7.2.6-1
- 7.2.6-1~bpo13+1
- 7.2.7-1
- 7.2.8-1
- 7.2.9-1
- 7.2.9-1~bpo13+1
- 7.2~rc3-1~exp1
- 7.2~rc5-1~exp1
- 7.2~rc7-1~exp1
- 7.3~rc6-1~exp1
- 7.3~rc7-1~exp1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
linux Debian:14
- Versions
- 6.12.100-1
- 6.12.101-1
- 6.12.105-1
- 6.12.107-1
- 6.12.111-1
- 6.12.113-1
- 6.12.38-1
- 6.12.41-1
- 6.12.43-1
- 6.12.43-1~bpo12+1
- 6.12.48-1
- 6.12.57-1
- 6.12.57-1~bpo12+1
- 6.12.63-1
- 6.12.63-1~bpo12+1
- 6.12.69-1
- 6.12.69-1~bpo12+1
- 6.12.73-1
- 6.12.73-1~bpo12+1
- 6.12.74-1
- 6.12.74-2
- 6.12.74-2~bpo12+1
- 6.12.85-1
- 6.12.85-1~bpo12+1
- 6.12.86-1
- 6.12.86-1~bpo12+1
- 6.12.88-1
- 6.12.88-1~bpo12+1
- 6.12.90-1
- 6.12.90-1~bpo12+1
- 6.12.90-2
- 6.12.90-2~bpo12+1
- 6.12.94-1
- 6.12.94-1~bpo12+1
- 6.12.95-1
- 6.12.95-1~bpo12+1
- 6.12.96-1
- 6.13.10-1~exp1
- 6.13.11-1~exp1
- 6.13.2-1~exp1
- 6.13.3-1~exp1
- 6.13.4-1~exp1
- 6.13.5-1~exp1
- 6.13.6-1~exp1
- 6.13.7-1~exp1
- 6.13.8-1~exp1
- 6.13.9-1~exp1
- 6.13~rc6-1~exp1
- 6.13~rc7-1~exp1
- 6.14.3-1~exp1
- 6.14.5-1~exp1
- 6.14.6-1~exp1
- 6.15-1~exp1
- 6.15.1-1~exp1
- 6.15.2-1~exp1
- 6.15.3-1~exp1
- 6.15.4-1~exp1
- 6.15.5-1~exp1
- 6.15.6-1~exp1
- 6.15~rc7-1~exp1
- 6.16-1~exp1
- 6.16.1-1~exp1
- 6.16.10-1
- 6.16.11-1
- 6.16.12-1
- 6.16.12-1~bpo13+1
- 6.16.12-2
- 6.16.3-1
- 6.16.3-1~bpo13+1
- 6.16.5-1
- 6.16.6-1
- 6.16.7-1
- 6.16.8-1
- 6.16.9-1
- 6.16~rc7-1~exp1
- 6.17.10-1
- 6.17.11-1
- 6.17.12-1
- 6.17.13-1
- 6.17.13-1~bpo13+1
- 6.17.2-1~exp1
- 6.17.5-1~exp1
- 6.17.6-1
- 6.17.7-1
- 6.17.7-2
- 6.17.8-1
- 6.17.8-1~bpo13+1
- 6.17.9-1
- 6.18.1-1~exp1
- 6.18.10-1
- 6.18.12-1
- 6.18.12-1~bpo13+1
- 6.18.13-1
- 6.18.14-1
- 6.18.15-1
- 6.18.15-1~bpo13+1
- 6.18.2-1~exp1
- 6.18.3-1
- 6.18.5-1
- 6.18.5-1~bpo13+1
- 6.18.8-1
- 6.18.9-1
- 6.18.9-1~bpo13+1
- 6.18~rc4-1~exp1
- 6.18~rc4-1~exp2
- 6.18~rc5-1~exp1
- 6.18~rc6-1~exp1
- 6.18~rc7-1~exp1
- 6.19-1~exp1
- 6.19.10-1
- 6.19.10-1~bpo13+1
- 6.19.11-1
- 6.19.11-1~bpo13+1
- 6.19.12-1
- 6.19.13-1
- 6.19.13-1~bpo13+1
- 6.19.14-1
- 6.19.14-1~bpo13+1
- 6.19.2-1~exp1
- 6.19.3-1~exp1
- 6.19.4-1~exp1
- 6.19.5-1~exp1
- 6.19.6-1
- 6.19.6-2
- 6.19.6-2~bpo13+1
- 6.19.8-1
- 6.19.8-1~bpo13+1
- 6.19~rc4-1~exp1
- 6.19~rc5-1~exp1
- 6.19~rc6-1~exp1
- 6.19~rc7-1~exp1
- 6.19~rc8-1~exp1
- 7.0-1~exp1
- 7.0.1-1~exp1
- 7.0.10-1
- 7.0.10-1~bpo13+1
- 7.0.12-1
- 7.0.12-2
- 7.0.12-2~bpo13+1
- 7.0.13-1
- 7.0.13-1~bpo13+1
- 7.0.14-1
- 7.0.3-1
- 7.0.4-1
- 7.0.4-1~bpo13+1
- 7.0.7-1
- 7.0.7-1~bpo13+1
- 7.0.9-1
- 7.0.9-1~bpo13+1
- 7.1.1-1~exp1
- 7.1.10-1
- 7.1.12-1
- 7.1.13-1
- 7.1.13-1~bpo13+1
- 7.1.2-1~exp1
- 7.1.3-1
- 7.1.3-1+sunvdc
- 7.1.3-1~bpo13+1
- 7.1.4-1
- 7.1.5-1
- 7.1.6-1
- 7.1.7-1
- 7.1.7-1~bpo13+1
- 7.1.8-1
- 7.1.8-1~bpo13+1
- 7.1.8-2
- 7.1.9-1
- 7.1.9-1+sparc64
- 7.1~rc2-1~exp1
- 7.1~rc3-1~exp1
- 7.1~rc4-1~exp1
- 7.1~rc4-1~exp2
- 7.1~rc5-1~exp1
- 7.1~rc7-1~exp1
- 7.2.10-1
- 7.2.2-1~exp1
- 7.2.3-1~exp1
- 7.2.6-1
- 7.2.6-1~bpo13+1
- 7.2.7-1
- 7.2.8-1
- 7.2.9-1
- 7.2.9-1~bpo13+1
- 7.2~rc3-1~exp1
- 7.2~rc5-1~exp1
- 7.2~rc7-1~exp1
- Affected ranges
- ECOSYSTEM: < 7.2.11-1
Update to 7.2.11-1