CVE-2026-98994: statmount: read the parent of an unmounted mount under mount_lock

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

statmount: read the parent of an unmounted mount under mountlock

statmountmntbasic() reads the ids of the parent through m->mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything above it is pinned by that namespace.

STATMOUNTBYFD also accepts a file descriptor on a mount that has been unmounted on purpose and that only the file descriptor keeps alive. If that mount stayed attached to its parent when it was unmounted the parent is unmounted as well and nothing pins it for the child.

The final mntput() unmounts the children under mountlock alone and frees the parent afterwards. Concurrently, statmountmntbasic() reads m->mntparent twice while that can happen and can easily dereference a mount that's already gone.

Read the parent of an unmounted mount under mountlock. The parent can't be put while it is held and both ids come from the same mount. A mounted mount's parent is pinned by the namespace and a mount can't leave its namespace while namespacesem is held, so the common case takes no global lock.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 23, 2026

CVE Published

via MITRE·12:20 PM

Data Sourced

via MITRE·12:20 PM

Description

Frequently Asked Questions

What condition is required to trigger this issue?

The vulnerable path requires STATMOUNT_BY_FD to be used with a file descriptor referring to a mount that was deliberately unmounted but remains alive only because of that file descriptor. It also requires concurrent teardown of the mount hierarchy so that the parent can be freed while its IDs are being read.

Are ordinary mounts that remain in a mount namespace affected by the same race?

The common case for mounts still in a namespace is protected because the namespace pins the parent and the mount cannot leave its namespace while namespace_sem is held. The described exposure is specifically for unmounted mounts accessed through STATMOUNT_BY_FD.

What does the fix change?

For an unmounted mount, the fix reads the parent while holding mount_lock. This prevents the parent from being released during the read and ensures both parent IDs are obtained from the same mount.

CVE-2026-98994: statmount: read the parent of an unmounted mount under mount_lock

Affected Software

Event History

Frequently Asked Questions

What condition is required to trigger this issue?

Are ordinary mounts that remain in a mount namespace affected by the same race?

What does the fix change?

Company

Resources

Contact

Frequently Asked Questions

What condition is required to trigger this issue?

Are ordinary mounts that remain in a mount namespace affected by the same race?

What does the fix change?