Answer in brief
CVE-2026-98983 records a Unknown severity vulnerability in unshare: don't drop active namespace references that were never taken. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a98621a0f187a934c115dcfe79a49520ae892111 <56fe03a0c05dba4c5f6a23c391f96de1614a098c || >=a98621a0f187a934c115dcfe79a49520ae892111 <0b6f31a3c0b16066f812e94b52a704174a6f23cd || 27ae6b17c9ba7ff353ab0906297f08aa845782b4 || 297261b343371c4f0b31055d53d285138ec21565 || 813a47b0309097da71781ee4ac11922e39b67d55 || 6e608e3e5ce12ce7fd21e46212eccca37f917d0e || a261fccdb4ac58ec5ba6aa1d92a6cc418fff301f || 665dc1ed16357988d439fc5bbc860ee36f540d81 || >=5.15.209 <5.16 || >=6.1.175 <6.2 || >=6.6.141 <6.7 || >=6.12.91 <6.13 || >=6.18.33 <6.19 || >=7.0.10 <7.1 | 56fe03a0c05dba4c5f6a23c391f96de1614a098c, 0b6f31a3c0b16066f812e94b52a704174a6f23cd, 5.16, 6.2, 6.7, 6.13, 6.19, 7.1 |
| Linux/Linuxgeneric | 7.1 | Not reported |
Published upstream
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 23, 2026
In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy(). But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using: WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid. Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.
Quoted source text, attributed separately from HOL analysis.