---
id: CVE-2026-98976
title: 'namespace: keep the lock on a mount that a propagated copy is moved beneath'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  namespace: keep the lock on a mount that a propagated copy is moved beneath

  attach_recursive_mnt() transfers MNT_LOCKED from the top mount to the
  mount that is moved b…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c62a4766937edec2962d52e583276b459b739f2d <
    f1f0c24ca701d7d3061c7f69f7450f1734c11745
  - >-
    Linux >= c62a4766937edec2962d52e583276b459b739f2d <
    d74d66aa708ccf2bc0b1e265a83fed0f2308d5c4
  - Linux 7.1
published: '2026-10-23'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:09:46.343Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98976'
references:
  - url: 'https://git.kernel.org/stable/c/f1f0c24ca701d7d3061c7f69f7450f1734c11745'
  - url: 'https://git.kernel.org/stable/c/d74d66aa708ccf2bc0b1e265a83fed0f2308d5c4'
tags:
  - cve.org
epss: 0.00198
epssPercentile: 0.08995
ingestedAt: '2026-10-23T13:24:55.550Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

namespace: keep the lock on a mount that a propagated copy is moved beneath

attach_recursive_mnt() transfers MNT_LOCKED from the top mount to the
mount that is moved beneath it with MOVE_MOUNT_BENEATH. This allows the
owner of a user namespace to replace its locked /proc or its root. The
mount beneath takes on the job of covering the underlying mountpoint
allowing the top mount to be unmounted.

Consider two mount namespaces:

(H) The host H has a shared mount P with a secret in P/d
(Z) Z is a user namespace made from M. Its copy of P receives
    propagation from the host's P and its copy of M's cover on P/d is
    locked Z's owner must not get to see P/d.

Now (H) mounts X on P/d. This propagates into (Z). The copy of X lands
beneath (Z)'s locked cover. The locked property is transfered from (Z)'s
cover to the copy of X propagated beneath it. The cover is now unlocked.

Now (H) unmounts X again. The copy of X in (Z) gets unmounted and the
covering mount is left unlocked on top of P/d. (Z) can now unmount it:

    Z: umount2(P/d)             = EINVAL            /* the cover is locked */
    H: mount X on P/d, umount X                     /* both propagate into Z /*
    Z: umount2(P/d)             = 0                 /* the cover is now unlocked */
    Z: read P/d/secret          = "covered-by-root" /* secret revealed */

So only transfer the locked property to the mount beneath for mounts the
caller has placed. A propagated copy that lands beneath a locked mount
is locked as well so that the mount at the bottom of the stack carries a
lock the way every check expects. The mount on top of it remains locked
to ensure that it keeps covering even if the propagated mount is
unmounted again.

## Affected

- `Linux >= c62a4766937edec2962d52e583276b459b739f2d < f1f0c24ca701d7d3061c7f69f7450f1734c11745`
- `Linux >= c62a4766937edec2962d52e583276b459b739f2d < d74d66aa708ccf2bc0b1e265a83fed0f2308d5c4`
- `Linux 7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.