CVE-2026-98996 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
fs: don't silently unmount busy mounts
The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those functions from propagation hell.
It skips a copy that has child mounts except for the case of a single child mount covering the copy's root. That algorithm used to be exact. It isn't anymore.
Originally only childless copies were unmounted during propagation. And 1064f874abc0 ("mnt: Tuck mounts under others instead of creating shadow/side mounts.") ended up adding covered mounts to both sides in one go.
Along came 99b19d16471e ("mnt: In propgate_umount handle visiting mounts in any order") and that started to unmount more than before:
[1]: A copy of a mount is unmounted when each of its children is either
its overmount or a copy of the victim itself. In the former case the overmount gets reparented. In the latter case the copy of the victim will end up being unmounted.
So propagate_umount() ended up being rewritten without adjusting propagate_mount_busy(). And currently propagate_mount_busy() doesn't look at copies of the victim that have two or more children nor a single child that is not the overmount.
So any such copy in [1] is not checked for
references. The result is that a synchronous unmount succeeds, pulling out a mount that is still in use.
A container can run into this with its own mounts. The host shares a tree with the container and the host has a mount in that tree:
mount -t tmpfs none /mnt mount --make-shared /mnt mount -t tmpfs none /mnt/a
The container's /mnt is a slave copy of the host mount. The container now takes a detached copy of the tree and mounts that copy beneath its propagated copy of /mnt/a and keeps the file descriptor to the tree open:
unshare -m --propagation unchanged mount --make-rslave / fd = open_tree(AT_FDCWD, "/mnt", OPEN_TREE_CLONE | AT_RECURSIVE) move_mount(fd, "", AT_FDCWD, "/mnt/a", MOVE_MOUNT_BENEATH)
grep /mnt /proc/self/mountinfo 775 355 ... /mnt ... master:646 777 775 ... /mnt/a ... master:646 776 777 ... /mnt/a ... master:647 778 777 ... /mnt/a/a ... master:647
The now attached tree (777) is now mounted beneath the container's copy of /mnt/a. That's also where the host mount sits (as seen from the host mount namespace). So the propagated copy (776) of the host's mount is on top of its root and the copy of that (778) is inside it. Now the host runs:
umount /mnt/a
and it succeeds. The moved tree tree and the copy inside of it are gone from the container. Now only the propagated copy is left and it got reparented to where it was before:
grep /mnt /proc/self/mountinfo 775 355 ... /mnt ... master:646 776 775 ... /mnt/a ...
But the file descriptor still refers to the moved tree. So a synchronous umount detached a mount that is still in use.
Teach propagate_mount_busy() the same checks that propagate_umount() does. It now checks for a single victim mount without children for which it can assume that MNT_LOCKED is cleared on every copy like propagate_umount() does. The copies form chains. IOW, when a copy itself receives propagation from the victim's parent then the mount at the same mountpoint inside that copy is a copy as well. Whether a mount receives propagation from the victim's can simply be checked by walking its masters. Walk each chain once from its top so we are sure that nested copies stay linear. Check every reference once of every copy that gets unmounted.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel contains a critical logic flaw within the filesystem mount propagation subsystem, specifically in the propagate_mount_busy helper function used during synchronous unmount operations. This vulnerability arises from an inconsistency between how the kernel determines if a mount is busy and how it actually performs the unmount when dealing with shared or slave mount trees. Historically, the algorithm for determining whether a copy of a victim mount could be safely unmounted was exact, focusing on childless copies to avoid disrupting active references. However subsequent changes to handle covered mounts and propagate umounts in any order introduced a regression where the busy check logic was not updated to match the new unmount behavior. Specifically, propagate_mount_busy fails to inspect copies of victim mounts that have two or more children, as well as single-child cases where the child is not an overmount. This oversight means that synchronous unmount operations can succeed even when they pull out a mount structure that remains actively referenced by other parts of the system, leading to silent data loss and potential kernel instability.
The operational impact of this vulnerability is severe for environments utilizing containerization or complex namespace isolation where host and guest filesystem trees are shared via propagation mechanisms. In such scenarios, a container may maintain an open file descriptor referencing a detached copy of a mount tree while simultaneously having that same tree mounted beneath its own propagated root. When the host system initiates an unmount on the original path, the kernel incorrectly determines that no busy references exist because it fails to account for the nested copies within the container's namespace. Consequently, the unmount proceeds and removes the moved tree from the container’s view, leaving only a reparented copy behind. The file descriptor held by the container process now points to an invalidated or detached mount structure, which can lead to undefined behavior when subsequent I/O operations are attempted on that descriptor. This represents a significant breach of filesystem integrity guarantees within isolated environments.
From a technical classification perspective, this flaw aligns with CWE-665 Improper Initialization and CWE-829 Inclusion of Functionality from Untrusted Control Sources, as the kernel fails to properly validate the state of propagated mount structures before allowing their removal. It also relates to race conditions in resource management where reference counting or busy checks are not synchronized with structural changes in the mount tree. The vulnerability exploits the complexity of Linux mount propagation chains, particularly how master and slave relationships interact during recursive operations. Attackers or misconfigured applications can trigger this state by carefully arranging nested mounts and maintaining open file descriptors to detached trees, effectively causing a denial of service through resource invalidation or potentially escalating privileges if the corrupted mount structures are manipulated further in memory.
Mitigation strategies primarily involve applying kernel patches that correct the propagate_mount_busy logic to mirror the checks performed by propagate_umount. The fix requires teaching the busy check function to traverse master chains and verify references for all copies of victim mounts, ensuring that nested copies remain linear and that every reference is accounted for before an unmount proceeds. Administrators should ensure their systems are updated with kernel versions containing this specific filesystem propagation fix. Additionally, developers utilizing mount namespaces and shared subtrees should audit applications that maintain long-lived file descriptors to detached or moved mount points, as these patterns increase the likelihood of triggering the vulnerability until the underlying kernel logic is corrected.