CVE-2026-99172

In the Linux kernel, the following vulnerability has been resolved:

ipc: drop the mqueue mount with kern unmount() on setup failure

mq init ns() creates the mqueue mount with fc mount longterm(), so its ->mnt ns is MNT NS INTERNAL. When setting up the mqueue or ipc sysctls or msg init ns() fails afterwards, create ipc ns() drops it with a plain mntput(). With ->mnt ns set that takes the fast path of mntput no expire(). The count drops to zero and nothing ever kills the mount, so the mount and the mqueue superblock are leaked.

Commit dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace") added the first failure path after mq init ns() and never dropped the mount. Commit 7229d74e5e8c ("ipc: create ipc ns: drop mqueue mount on sysctl setup failure") tried to fix that with a mntput() but that doesn't help for a long-term mount.

Use kern unmount(). free ipc() open-codes the same thing for a namespace that made it.