Answer in brief
CVE-2026-98982 records a High severity (CVSS 7.8) vulnerability in namespace: don't let a pseudo dentry become the root of a mount. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=35f96de04127d332a5c5e8a155d31f452f88c76d <a256e31e0c54c4c37d2523aa52faabdcdd2ebc07 || >=35f96de04127d332a5c5e8a155d31f452f88c76d <7e1c466011ba9e64d43075396badc03191bcee44 || >=35f96de04127d332a5c5e8a155d31f452f88c76d <00287afa7cd989efdbf5822b7efac33cce7d489a || >=35f96de04127d332a5c5e8a155d31f452f88c76d <b138e16fb1e81376cea89f727dda7bfccd140de4 | a256e31e0c54c4c37d2523aa52faabdcdd2ebc07, 7e1c466011ba9e64d43075396badc03191bcee44, 00287afa7cd989efdbf5822b7efac33cce7d489a, b138e16fb1e81376cea89f727dda7bfccd140de4 |
| Linux/Linuxgeneric | 6.9 | Not reported |
Published upstream
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 23, 2026
In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloc_pseudo() hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHE_NORCU and dentry_free() frees them right away because no lockless path walk can ever reach them. That holds as long as such a dentry isn't the root of a mount. But bind mounting /proc/self/fd/<fd> of such a file does exactly that. Most callers of alloc_file_pseudo() put their files on kernel-internal mounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It places the token file on the bpffs mount the caller handed it and that mount is in the caller's mount namespace so the clone goes through: mount --bind /proc/self/fd/<token> <file> open_tree(tokfd, "", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount() __follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq and d_flags of the dentry and only then checks mount_lock. The dentry can be gone by then. The final mntput() of an unmounted parent unhooks a child that stayed attached to it under mount_lock alone. When the child's holder does the final put right after that the root is dput() and freed immediately while a walker that found the mount hashed still looks at it. Refuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing sensible can be done with a bind mount of a bpf token anyway.
Quoted source text, attributed separately from HOL analysis.