CVE-2026-98995: namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

In the Linux kernel, the following vulnerability has been resolved:

namespace: reset the old parent's ->overmount in mntchangemountpoint()

umountmnt() resets ->overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint() doesn't. It moves the mount to its new parent and leaves the old one pointing at it.

For a mount that is moved beneath in attachrecursivemnt() that doesn't matter. The new mount has already reset ->overmount of the old parent by the time the old top mount is moved onto it.

It matters for reparent() though. propagateumount() moves a surviving overmount onto the first ancestor that isn't going to be unmounted. The mount it was taken from is unmounted immediately afterwards. If a file descriptor keeps that unmounted mount alive ->overmount points at the moved mount. That's a dangling pointer and UAF as the moved mount is unmounted and freed.

dolockmount() follows ->overmount from the target path under mountlock. With a file descriptor on such a mount as the target of a mount beneath topmostovermount() walks into the freed mount and dolockmount() takes references on whatever it finds there.

So reset ->overmount of the old parent in mntchangemountpoint() the same way umountmnt() does. A mount's ->overmount is then always a mount that is attached to it.