UBUNTU-CVE-2026-97971: High severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimizens() takes a reference on the candidate namespace before maylistns() has decided whether the caller may see it. The free(nsput) cleanup on the denied path can drop the last reference to a mount namespace while we still hold the rcu read lock, and putmntns() may sleep there. This is the same problem commit 2ec2aff3c8e2 ("ns: make sure reference are dropped outside of rcu lock") fixed for the putuser() path. Neither nsrequested() nor maylistns() needs a reference, both only look at the namespace type and at the caller's own namespaces, so do the checks first and take the reference last. Splat: Voluntary context switch within RCU read-side critical section! WARNING: kernel/rcu/treeplugin.h:332 at rcunotecontextswitch+0x238/0x2a0, CPU#5: a/3442 CPU: 5 UID: 1000 PID: 3442 Comm: a Not tainted 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy) RIP: 0010:rcunotecontextswitch+0x238/0x2a0 Call Trace: <TASK> schedule+0xcf/0x650 schedule+0x27/0x90 schedulepreemptdisabled+0x15/0x30 mutexlock.constprop.0+0x550/0xaf0 mutexlockslowpath+0x13/0x20 mutexlock+0x3b/0x50 expfunnellock+0xb2/0x260 synchronizercuexpedited+0xe7/0x220 namespaceunlock+0x26a/0x320 putmntns+0xd3/0x120 mntnsput+0xe/0x20 dolistns+0x13e/0x560 dosyslistns+0x126/0x2d0 x64syslistns+0x20/0x30 x64syscall+0x2366/0x2390 dosyscall64+0x105/0x5a0 entrySYSCALL64afterhwframe+0x76/0x7e </TASK>