CVE-2026-98983None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In the Linux kernel, the following vulnerability has been resolved:
unshare: don't drop active namespace references that were never taken
Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy().
But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using:
WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare
Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid.
Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.
Linux >= a98621a0f187a934c115dcfe79a49520ae892111 < 56fe03a0c05dba4c5f6a23c391f96de1614a098cLinux >= a98621a0f187a934c115dcfe79a49520ae892111 < 0b6f31a3c0b16066f812e94b52a704174a6f23cdLinux 27ae6b17c9ba7ff353ab0906297f08aa845782b4Linux 297261b343371c4f0b31055d53d285138ec21565Linux 813a47b0309097da71781ee4ac11922e39b67d55Linux 6e608e3e5ce12ce7fd21e46212eccca37f917d0eLinux a261fccdb4ac58ec5ba6aa1d92a6cc418fff301fLinux 665dc1ed16357988d439fc5bbc860ee36f540d81Linux >= 5.15.209 < 5.16Linux >= 6.1.175 < 6.2Linux >= 6.6.141 < 6.7Linux >= 6.12.91 < 6.13Linux >= 6.18.33 < 6.19Linux >= 7.0.10 < 7.1Linux 7.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99001Nonedrm/xe/i2c: cancel the client work on remove
CVE-2026-98989Nonenamespace: check a recursive bind mount for mount namespace loops
CVE-2026-98988Nonenamespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98992Nonenamespace: don't copy an unmounted mount tree
CVE-2026-98991Nonenamespace: queue a mount only once for mount notifications
CVE-2026-98990Nonenamespace: check a submount for references right before unmounting it