{
  "cveId": "CVE-2026-98991",
  "url": "https://patchblox.com/security/cve/CVE-2026-98991",
  "summary": "CVE-2026-98991 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98991 (version 7.2.11-1), released October 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  namespace: queue a mount only once for mount not...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  namespace: queue a mount only once for mount notifications  mnt_notify_add() puts a mount on notify_list. It doesn\u0027t check whether the mount is on the list already. That\u0027s fine as long as every mount is queued at most once per namespace_sem hold. It isn\u0027t.  propagate_umount() moves a surviving overmount off a stack of mounts that are going away and queues it as moved. shrink_submounts() and mark_mounts_for_expiry() call umount_tree() for several mounts under a single namespace_sem hold. So the second umount_tree() can take down exactly the mount the first one reparented, reparent it once more and so end up queueing it a second time.  The second list_add_tail() cuts the mounts queued in between out of the list while the head still points at the last of them. notify_mnt_list() then only visits that one mount and the others are freed after the grace period with notify_list still pointing at them. Every later mount operation on the host walks freed memory:    BUG: KASAN: slab-use-after-free in __list_add_valid_or_report   Read of size 8 at addr ffff8881003d57e0 by task notify_dq/162    __list_add_valid_or_report\u002B0x15c/0x1a0    mnt_add_to_ns\u002B0x322/0x890    attach_recursive_mnt.isra.0\u002B0xf2a/0x1a00    path_mount\u002B0x139c/0x1d40  This needs a mount with MNT_SHRINKABLE to bind from. That\u0027s what finish_automount() creates (submounts of NFS, AFS and CIFS and the tracefs mount below debugfs). Bind mounts inherit the flag. A mount namespace with a FAN_MARK_MNTNS mark does the rest and root in a user namespace can have both.  Initialize to_notify in alloc_vfsmnt() and leave a mount alone that is queued already. mnt_notify() looks at the state the mount has when the list is drained so a single entry per mount is enough. The move event for a mount that is unmounted under the same hold is lost. That\u0027s fine. The detach is what matters.",
  "published": "2026-10-23T13:17:21Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00157,
  "epssPercentile": 0.04859,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.11-1",
      "fix": "DEBIAN-CVE-2026-98991",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-98991",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}