{"id":"CVE-2026-98983","title":"unshare: don't drop active namespace references that were never taken","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nunshare: don't drop active namespace references that were never taken\n\nActive references on the namespaces of an nsproxy are taken when the\nnsproxy is installed into a …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= a98621a0f187a934c115dcfe79a49520ae892111 < 56fe03a0c05dba4c5f6a23c391f96de1614a098c","Linux >= a98621a0f187a934c115dcfe79a49520ae892111 < 0b6f31a3c0b16066f812e94b52a704174a6f23cd","Linux 27ae6b17c9ba7ff353ab0906297f08aa845782b4","Linux 297261b343371c4f0b31055d53d285138ec21565","Linux 813a47b0309097da71781ee4ac11922e39b67d55","Linux 6e608e3e5ce12ce7fd21e46212eccca37f917d0e","Linux a261fccdb4ac58ec5ba6aa1d92a6cc418fff301f","Linux 665dc1ed16357988d439fc5bbc860ee36f540d81","Linux >= 5.15.209 < 5.16","Linux >= 6.1.175 < 6.2","Linux >= 6.6.141 < 6.7","Linux >= 6.12.91 < 6.13","Linux >= 6.18.33 < 6.19","Linux >= 7.0.10 < 7.1","Linux 7.1"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:20:00.918Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98983","references":[{"url":"https://git.kernel.org/stable/c/56fe03a0c05dba4c5f6a23c391f96de1614a098c"},{"url":"https://git.kernel.org/stable/c/0b6f31a3c0b16066f812e94b52a704174a6f23cd"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.548Z","slug":"CVE-2026-98983","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nunshare: don't drop active namespace references that were never taken\n\nActive references on the namespaces of an nsproxy are taken when the\nnsproxy is installed into a task in switch_task_namespaces() and\ncopy_namespaces() and dropped again by put_nsproxy() through\ndeactivate_nsproxy().\n\nBut ksys_unshare() calls put_nsproxy() on an nsproxy that was never\ninstalled when set_cred_ucounts() fails. The new namespaces of that\nnsproxy go from zero to minus one and the namespaces shared with the\ncaller lose a reference that belongs to the nsproxy the caller keeps\nusing:\n\n  WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230\n   nsproxy_ns_active_put\n   deactivate_nsproxy\n   ksys_unshare\n\nAfterwards the namespaces the caller lives in aren't listed by listns()\nanymore. set_cred_ucounts() only fails when alloc_ucounts() can't\nallocate and it only allocates when the real uid of the caller differs\nfrom its effective uid.\n\nCommit cefd55bd2159 (\"nsproxy: fix free_nsproxy() and simplify\ncreate_new_namespaces()\") separated the two cases on purpose.\nnsproxy_free() frees an nsproxy that was prepared but never installed\nand that's what a failed setns() uses in put_nsset(). Export it and use\nit for a failed unshare() as well.\n\n## Affected\n\n- `Linux >= a98621a0f187a934c115dcfe79a49520ae892111 < 56fe03a0c05dba4c5f6a23c391f96de1614a098c`\n- `Linux >= a98621a0f187a934c115dcfe79a49520ae892111 < 0b6f31a3c0b16066f812e94b52a704174a6f23cd`\n- `Linux 27ae6b17c9ba7ff353ab0906297f08aa845782b4`\n- `Linux 297261b343371c4f0b31055d53d285138ec21565`\n- `Linux 813a47b0309097da71781ee4ac11922e39b67d55`\n- `Linux 6e608e3e5ce12ce7fd21e46212eccca37f917d0e`\n- `Linux a261fccdb4ac58ec5ba6aa1d92a6cc418fff301f`\n- `Linux 665dc1ed16357988d439fc5bbc860ee36f540d81`\n- `Linux >= 5.15.209 < 5.16`\n- `Linux >= 6.1.175 < 6.2`\n- `Linux >= 6.6.141 < 6.7`\n- `Linux >= 6.12.91 < 6.13`\n- `Linux >= 6.18.33 < 6.19`\n- `Linux >= 7.0.10 < 7.1`\n- `Linux 7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}