{
  "cveId": "CVE-2026-98976",
  "url": "https://patchblox.com/security/cve/CVE-2026-98976",
  "summary": "CVE-2026-98976 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98976 (version 7.2.11-1), released October 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  namespace: keep the lock on a mount that a propa...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  namespace: keep the lock on a mount that a propagated copy is moved beneath  attach_recursive_mnt() transfers MNT_LOCKED from the top mount to the mount that is moved beneath it with MOVE_MOUNT_BENEATH. This allows the owner of a user namespace to replace its locked /proc or its root. The mount beneath takes on the job of covering the underlying mountpoint allowing the top mount to be unmounted.  Consider two mount namespaces:  (H) The host H has a shared mount P with a secret in P/d (Z) Z is a user namespace made from M. Its copy of P receives     propagation from the host\u0027s P and its copy of M\u0027s cover on P/d is     locked Z\u0027s owner must not get to see P/d.  Now (H) mounts X on P/d. This propagates into (Z). The copy of X lands beneath (Z)\u0027s locked cover. The locked property is transfered from (Z)\u0027s cover to the copy of X propagated beneath it. The cover is now unlocked.  Now (H) unmounts X again. The copy of X in (Z) gets unmounted and the covering mount is left unlocked on top of P/d. (Z) can now unmount it:      Z: umount2(P/d)             = EINVAL            /* the cover is locked */     H: mount X on P/d, umount X                     /* both propagate into Z /*     Z: umount2(P/d)             = 0                 /* the cover is now unlocked */     Z: read P/d/secret          = \u0022covered-by-root\u0022 /* secret revealed */  So only transfer the locked property to the mount beneath for mounts the caller has placed. A propagated copy that lands beneath a locked mount is locked as well so that the mount at the bottom of the stack carries a lock the way every check expects. The mount on top of it remains locked to ensure that it keeps covering even if the propagated mount is unmounted again.",
  "published": "2026-10-23T13:17:19Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss": 0.00137,
  "epssPercentile": 0.03162,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.11-1",
      "fix": "DEBIAN-CVE-2026-98976",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98976",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}