CVE-2026-98982: namespace: don't let a pseudo dentry become the root of a mount

In the Linux kernel, the following vulnerability has been resolved:

namespace: don't let a pseudo dentry become the root of a mount

dallocpseudo() hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree() frees them right away because no lockless path walk can ever reach them. That holds as long as such a dentry isn't the root of a mount. But bind mounting /proc/self/fd/<fd> of such a file does exactly that.

Most callers of allocfilepseudo() put their files on kernel-internal mounts and maycopytree() refuses those. bpftokencreate() doesn't. It places the token file on the bpffs mount the caller handed it and that mount is in the caller's mount namespace so the clone goes through:

mount --bind /proc/self/fd/<token> <file> opentree(tokfd, "", ATEMPTYPATH | OPENTREECLONE) + movemount()

followmountrcu() then loads ->mntroot of that mount, reads dseq and dflags of the dentry and only then checks mountlock. The dentry can be gone by then. The final mntput() of an unmounted parent unhooks a child that stayed attached to it under mountlock alone. When the child's holder does the final put right after that the root is dput() and freed immediately while a walker that found the mount hashed still looks at it.

Refuse to clone a mount with a DCACHENORCU dentry as its root. Nothing sensible can be done with a bind mount of a bpf token anyway.