PT-2026-121970
CVE-2026-98993
·
Publicado
2026-10-23
·
Atualizado
2026-10-23
Descrição por
Pontuação
N/A
Não disponívelNão há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
namespace: don't inherit MNT UMOUNT in clone mnt()
MNT UMOUNT gets raised on a mount that umount tree() or umount one() has
taken out of its namespace. It's never cleared. detach mounts()
unhooks a mount that carries it instead of unmounting it.
disconnect mount() lets an unmounted child stay attached only if its
parent carries it. propagate umount() takes it as the sign that a mount
is going to be unmounted when it decides what else can be unmounted,
where a chain of locked mounts ends and where a for reparenting an
overmount.
clone mnt() copies the flags of the source and only masks
MNT INTERNAL FLAGS which doesn't include MNT UMOUNT. A mount that was
lazily unmounted but is kept alive by a file descriptor can still be
copied when its root is an nsfs or pidfs file because may copy tree()
accepts those before checking whether the source is mounted at all:
mount --bind /proc/self/ns/net /tmp/x
exec 3< /tmp/x
umount -l /tmp/x
mount --bind /proc/self/fd/3 /tmp/y
The mount on /tmp/y is attached to the caller's namespace with
MNT UMOUNT already set and every copy of it inherits the flag again.
That causes a number of bugs:
-
Unlink its mountpoint from a mount namespace where it isn't one. detach mounts() takes it for a mount that was unmounted earlier, unhooks it from its parent and drops the reference the namespace holds on it. It stays in the namespace with one reference too few and as its own parent, so it can't be unmounted through the file descriptor anymore and the namespace never finds it again. When the namespace goes away it's leaked and points to a freed struct mnt namespace that may change propagation() and anon ns root() read on the next propagation change or mount setattr() through the file descriptor.
-
Make it shared and unmount a peer. trace transfers() follows the flag from the peer into it and strips it from its peer group.
-
Let a propagated umount reach it. gather candidates() marks it with T UMOUNT CANDIDATE but never puts it on the candidate list, so the mark is never cleared and every later propagated umount skips it. If it's the parent of a locked mount handle locked() takes it as the cutoff and commits the locked child that should have stayed and disconnect mount() leaves that child attached to it, unmounted under a mounted parent, which is what disconnect mount() exists to prevent. When the namespace goes away umount tree() visits the child a second time. And once detach mounts() has made it its own parent reparent() never finds the end of the chain of unmounted parents.
A clone is a new mount that has never been unmounted. Add MNT UMOUNT
to MNT INTERNAL FLAGS so clone mnt() never copies it. And warn when
umount tree() reaches a mount that already has it set.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾