CVE-2026-97971: nstree: check listing permission before taking a namespace reference
In the Linux kernel, the following vulnerability has been resolved:
nstree: check listing permission before taking a namespace reference
legitimizens() takes a reference on the candidate namespace before maylistns() has decided whether the caller may see it. The free(nsput) cleanup on the denied path can drop the last reference to a mount namespace while we still hold the rcu read lock, and putmntns() may sleep there. This is the same problem commit 2ec2aff3c8e2 ("ns: make sure reference are dropped outside of rcu lock") fixed for the putuser() path. Neither nsrequested() nor maylistns() needs a reference, both only look at the namespace type and at the caller's own namespaces, so do the checks first and take the reference last.
Splat:
Voluntary context switch within RCU read-side critical section! WARNING: kernel/rcu/treeplugin.h:332 at rcunotecontextswitch+0x238/0x2a0, CPU#5: a/3442 CPU: 5 UID: 1000 PID: 3442 Comm: a Not tainted 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) RIP: 0010:rcunotecontextswitch+0x238/0x2a0 Call Trace: <TASK> schedule+0xcf/0x650 schedule+0x27/0x90 schedulepreemptdisabled+0x15/0x30 mutexlock.constprop.0+0x550/0xaf0 mutexlockslowpath+0x13/0x20 mutexlock+0x3b/0x50 expfunnellock+0xb2/0x260 synchronizercuexpedited+0xe7/0x220 namespaceunlock+0x26a/0x320 putmntns+0xd3/0x120 mntnsput+0xe/0x20 dolistns+0x13e/0x560 dosyslistns+0x126/0x2d0 x64syslistns+0x20/0x30 x64syscall+0x2366/0x2390 dosyscall64+0x105/0x5a0 entrySYSCALL64afterhwframe+0x76/0x7e </TASK>
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the problematic path?
The affected path is reached when nstree processes a candidate namespace for a caller that is not permitted to list it. The issue occurs on the permission-denied path, where a namespace reference can be dropped while an RCU read-side lock is still held.
How can an administrator tell whether this issue has been triggered?
A triggered condition can produce a kernel warning stating "Voluntary context switch within RCU read-side critical section!" The supplied trace includes rcu_note_context_switch, scheduling functions, mutex locking, and mount-namespace cleanup through put_mnt_ns().