CVE-2026-98983 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
unshare: don't drop active namespace references that were never taken
Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy().
But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using:
WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare
Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid.
Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel contains a reference counting flaw within the namespace management subsystem, specifically affecting the ksys_unshare system call when credential allocation fails. This vulnerability arises from an improper handling of active references on namespaces associated with an nsproxy structure during process isolation operations. Under normal circumstances, active references for namespaces are acquired when an nsproxy is installed into a task via switch_task_namespaces or copy_namespaces and are subsequently released through put_nsproxy which invokes deactivate_nsproxy. However, in the specific scenario where set_cred_ucounts fails due to memory allocation constraints during unshare operations, the kernel incorrectly calls put_nsproxy on an nsproxy that was never successfully installed into a task context. This erroneous call causes the reference count of new namespaces to drop from zero to negative one, effectively creating a use-after-free condition for shared resources and causing namespace references belonging to the caller to be erroneously decremented.
The operational impact of this flaw is significant as it leads to kernel warnings indicating invalid state transitions within nscommon.c and results in the corruption of namespace tracking data structures. Specifically, after the erroneous reference decrement occurs, the namespaces that the calling process resides in are no longer correctly listed by listns, which can disrupt system monitoring tools and potentially lead to further instability if other components rely on accurate namespace enumeration for security or resource management decisions. The failure condition is triggered when alloc_ucounts cannot allocate memory, a scenario that typically occurs only when the real user identifier of the caller differs from its effective user identifier, highlighting a specific edge case in privilege boundary handling during process unsharing operations.
This issue was addressed by aligning the error path behavior with established kernel practices for managing nsproxy lifecycles. The fix involves utilizing nsproxy_free instead of put_nsproxy when set_cred_ucounts fails during an unshare operation. This approach mirrors the logic previously implemented in commit cefd55bd2159 which separated cases for freeing prepared but never installed nsproxies, a pattern already correctly applied to failed setns operations via put_nsset. By exporting and reusing this free mechanism, the kernel ensures that resources associated with an uninstalled namespace proxy are properly cleaned up without affecting references held by other active tasks or causing negative reference counts that compromise system integrity.
From a vulnerability classification perspective, this defect aligns with CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization due to race conditions in reference counting and CWE-415 Double Free if the corrupted state leads to premature deallocation of shared namespace structures. In terms of attack surface mapping under MITRE ATT&CK for Enterprise or ICS, this relates to T1068 Exploitation for Privilege Escalation as improper handling of credential allocation during unshare could potentially be leveraged in conjunction with other vulnerabilities to achieve unauthorized access or denial of service through kernel panic. Mitigation strategies primarily involve applying the latest kernel patches that include the corrected error path logic, ensuring that systems running affected versions are updated promptly to prevent potential stability issues and maintain accurate namespace tracking for security auditing purposes.