CVE-2026-98982

In the Linux kernel, the following vulnerability has been resolved:

namespace: don't let a pseudo dentry become the root of a mount

d alloc pseudo() hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHE NORCU and dentry free() frees them right away because no lockless path walk can ever reach them. That holds as long as such a dentry isn't the root of a mount. But bind mounting /proc/self/fd/ of such a file does exactly that.

Most callers of alloc file pseudo() put their files on kernel-internal mounts and may copy tree() refuses those. bpf token create() doesn't. It places the token file on the bpffs mount the caller handed it and that mount is in the caller's mount namespace so the clone goes through:

mount --bind /proc/self/fd/ open tree(tokfd, "", AT EMPTY PATH | OPEN TREE CLONE) + move mount()

follow mount rcu() then loads ->mnt root of that mount, reads d seq and d flags of the dentry and only then checks mount lock. The dentry can be gone by then. The final mntput() of an unmounted parent unhooks a child that stayed attached to it under mount lock alone. When the child's holder does the final put right after that the root is dput() and freed immediately while a walker that found the mount hashed still looks at it.

Refuse to clone a mount with a DCACHE NORCU dentry as its root. Nothing sensible can be done with a bind mount of a bpf token anyway.