AZL-111323: CVE-2026-99172 affecting package kernel 6.6.157.1-1

Q: What condition triggers the resource leak?

The leak occurs when IPC namespace creation fails after mq_init_ns() has created the mqueue mount. The described failure points include mqueue or IPC sysctl setup and msg_init_ns().

Q: What resources remain allocated after the failure?

The mqueue mount and its mqueue superblock are leaked. A plain mntput() does not tear down this long-term internal mount when its reference count reaches zero.

Q: Which package version is identified as affected?

The affected package identified here is azure-linux/kernel version 6.6.157.1-1.

Q: What cleanup behavior resolves the issue?

The failure path must use kern_unmount() to drop the mqueue mount rather than mntput(). The same cleanup issue also applies to free_ipc() for a namespace that successfully created the mount.

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ipc: drop the mqueue mount with kernunmount() on setup failure

mqinitns() creates the mqueue mount with fcmountlongterm(), so its ->mntns is MNTNSINTERNAL. When setting up the mqueue or ipc sysctls or msginitns() fails afterwards, createipcns() drops it with a plain mntput(). With ->mntns set that takes the fast path of mntputnoexpire(). The count drops to zero and nothing ever kills the mount, so the mount and the mqueue superblock are leaked.

Commit dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace") added the first failure path after mqinitns() and never dropped the mount. Commit 7229d74e5e8c ("ipc: createipcns: drop mqueue mount on sysctl setup failure") tried to fix that with a mntput() but that doesn't help for a long-term mount.

Use kernunmount(). freeipc() open-codes the same thing for a namespace that made it.

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Event History

Oct 28, 2026

Advisory Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-99172

Frequently Asked Questions

What condition triggers the resource leak?

The leak occurs when IPC namespace creation fails after mq_init_ns() has created the mqueue mount. The described failure points include mqueue or IPC sysctl setup and msg_init_ns().

What resources remain allocated after the failure?

The mqueue mount and its mqueue superblock are leaked. A plain mntput() does not tear down this long-term internal mount when its reference count reaches zero.

Which package version is identified as affected?

The affected package identified here is azure-linux/kernel version 6.6.157.1-1.

What cleanup behavior resolves the issue?

The failure path must use kern_unmount() to drop the mqueue mount rather than mntput(). The same cleanup issue also applies to free_ipc() for a namespace that successfully created the mount.

AZL-111323: CVE-2026-99172 affecting package kernel 6.6.157.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What condition triggers the resource leak?

What resources remain allocated after the failure?

Which package version is identified as affected?

What cleanup behavior resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

What condition triggers the resource leak?

What resources remain allocated after the failure?

Which package version is identified as affected?

What cleanup behavior resolves the issue?