CVE-2026-98996 — fs: don't silently unmount busy mounts
In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those functions from propagation hell. It skips a copy that has child mounts except for the case of a single child mount covering the copy's root. That algorithm used to be exact. It isn't anymore. Originally only childless copies were unmounted during propagation. And 1064f874abc0 ("mnt: Tuck mounts under others instead of creating shadow/side mounts.") ended up adding covered mounts to both sides in one go. Along came 99b19d16471e ("mnt: In propgate_umount handle visiting mounts in any order") and that started to unmount more than before: [1]: A copy of a mount is unmounted when each of its children is either its overmount or a copy of the victim itself. In the former case the overmount gets reparented. In the latter case the copy of the victim will end up being unmounted. So propagate_umount() ended up being rewritten without adjusting propagate_mount_busy(). And currently propagate_mount_busy() doesn't look at copies of the victim that have two or more children nor a single child that is not the overmount. So any such copy in [1] is not checked for references. The result is that a synchronous unmount succeeds, pulling out a mount that is still in use. A container can run into this with its own mounts. The host shares a tree with the container and the host has a mount in that tree: mount -t tmpfs none /mnt mount --make-shared /mnt mount -t tmpfs none /mnt/a The container's /mnt is a slave copy of the host mount. The container now takes a detached copy of the tree and mounts that copy beneath its propagated copy of /mnt/a and keeps the file descriptor to the tree open: unshare -m --propagation unchanged mount --make-rslave / fd = open_tree(AT_FDCWD, "/mnt", OPEN_TREE_CLONE | AT_RECURSIVE) move_mount(fd, "", AT_FDCWD, "/mnt/a", MOVE_MOUNT_BENEATH) grep /mnt /proc/self/mountinfo 775 355 ... /mnt ... master:646 777 775 ... /mnt/a ... master:646 776 777 ... /mnt/a ... master:647 778 777 ... /mnt/a/a ... master:647 The now attached tree (777) is now mounted beneath the container's copy of /mnt/a. That's also where the host mount sits (as seen from the host mount namespace). So the propagated copy (776) of the host's mount is on top of its root and the copy of that (778) is inside it. Now the host runs: umount /mnt/a and it succeeds. The moved tree tree and the copy inside of it are gone from the container. Now only the propagated copy is left and it got reparented to where it was before: grep /mnt /proc/self/mountinfo 775 355 ... /mnt ... master:646 776 775 ... /mnt/a ... But the file descriptor still refers to the moved tree. So a synchronous umount detached a mount that is still in use. Teach propagate_mount_busy() the same checks that propagate_umount() does. It now checks for a single victim mount without children for which it can assume that MNT_LOCKED is cleared on every copy like propagate_umount() does. The copies form chains. IOW, when a copy itself receives propagation from the victim's parent then the mount at the same mountpoint inside that copy is a copy as well. Whether a mount receives propagation from the victim's can simply be checked by walking its masters. Walk each chain once from its top so we are sure that nested copies stay linear. Check every reference once of every copy that gets unmounted.
Who exploits it and how urgent it is
A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.
How the score was calculated
- EPSS 0.2% (30-day exploitation probability)+1
The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.
Remediation
Fixes and mitigations documented by the sources — linked to the original advisory.
No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.
First 24 hours
Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.
- Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
- No fix documented in the sources: reduce exposure and monitor the vendor advisory.
- Search available logs for exploit probes, errors and authentication anomalies.
Affected scope
Vendor, product and versions as the sources word them.
| Vendor | Product | Versions | Status | Source |
|---|---|---|---|---|
| Linux | Linux |
≥ 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 and < bf2c8dec26fb792876b5e9bde7030c45d8be3908≥ 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 and < a210ac218c307513d43e98a08f23c2dfbeeebc2f≥ 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 and < 6857e209015f95be7a8f19a9cd5dac345b9b9859version dc5ce95b0252d143497283f7f659840d4f8a79d0version fdb8f10499924d96b8eb60cc1354b278f6fcf0e9version bb4fbf094b440a9209ed88c8681960d4b26eec0fversion b43f81ef0babcc07db1eaaece37c989204e4ff00version 81311d1698c0c87c972ba71d3ce44a617b52ea21 and 6 more≥ 4.1.43 and < 4.2≥ 4.4.78 and < 4.5≥ 4.9.39 and < 4.10≥ 4.11.12 and < 4.12≥ 4.12.3 and < 4.13version 4.13 |
Vulnerable | CVE Program (cve.org) e CISA ADP |
EPSS over time FIRST
Oct 24, 2026 → Oct 30, 2026 · 7 reading(s) · max 0.21%
Detection
Read off the CVSS vector and the weakness class. Starting points, not tested rules.
- Not enough vector or weakness data: use the affected application’s logs as a starting point.
Timeline
What happened to this CVE, newest first.
- 2026
- Record published
- Affected products added · linux/linux
- Source status changed · → Received
- Record created in this database
- CVE published
Source activity
Repeated readings are counted rather than listed.
- 1× References added · Oct 23, 2026 – Oct 23, 2026
- 1× Official description updated · Oct 23, 2026 – Oct 23, 2026
References
3 on the record
Elsewhere on this site
Related CVEs (same products)
- Unknown CVE-2026-99216 Drivers: hv: Don't reset VMBus connection state on error/exit paths 2d
- Unknown CVE-2026-99215 power: supply: core: prevent unregistering a power supply while a callback runs 2d
- Unknown CVE-2026-99207 scsi: target: Disable interrupts while holding delayed_cmd_lock 2d
- Unknown CVE-2026-99208 drm/xe/oa: Zero OA buffer at allocation 2d
- Unknown CVE-2026-99209 drm/xe: skip eviction of a BO with no resource 2d
- Unknown CVE-2026-99210 accel/rocket: clear rdev on device init failure 2d
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No CVSS score published by NVD, the CNA, CISA or GitHub so far.
- No fixed version, patch or mitigation documented.
- No CISA SSVC assessment.
- No CWE classification.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.
Answered from this record
Text assembled only from the fields above — no additional claims.
What should defenders know first?
CVE-2026-98996 is "fs: don't silently unmount busy mounts", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.17% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.
Comments
Moderated technical discussion. Read the community guidelines.
No comments yet.
Sign in or create an account to comment and suggest corrections.