{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "1064f874abc0d05eeed8993815f584d847b72486"
            },
            {
              "fixed": "cda0c4e502a0f74a191471ce100fb061e5ab35d6"
            },
            {
              "fixed": "3f55f71291e4332983cd63b288d1f2be3c9c08fc"
            },
            {
              "fixed": "361f59e7f3f9a219fb5567bf9abc8482a154a399"
            },
            {
              "fixed": "f6394281834492c6516a405a348b545ae698a331"
            },
            {
              "fixed": "6e4012e571867868b545c91ca9d6095fdb709907"
            },
            {
              "fixed": "d73f04e92c1aab78d96ac6cadb234c8a3a373d22"
            },
            {
              "fixed": "18902a23ef36f83d32bafc58ae2484e6bb4bb8ef"
            },
            {
              "fixed": "32bf92416614a1e3ff3524fc6b780259c7aad3ef"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4.1.40"
            },
            {
              "fixed": "4.2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4.4.54"
            },
            {
              "fixed": "4.5"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4.9.15"
            },
            {
              "fixed": "4.10"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4.10.3"
            },
            {
              "fixed": "4.11"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5e6ef5ef6eaf690faad3a7c6c665ebf45d7b6ccf"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "839d42687dfce0ed0ea2c6bd8d707cc0e276fbe7"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "808e83e5add13152bd4a88346487de68395c136b"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6de9d08a9718ee9c12ba6343c50141c2d633e3dc"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.11.0"
            },
            {
              "fixed": "5.10.273"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.224"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.191"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.160"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.113"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.57"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98990.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: check a submount for references right before unmounting it\n\nshrink_submounts() and mark_mounts_for_expiry() first collect all the\nmounts they are allowed to unmount and then unmount them.\n\nWhether a mount is busy is decided by propagate_mount_busy() on the\ntree. But unmounting the first mount changes the tree that the second\none propagates into. propagate_umount()\nmoves a surviving overmount off a copy it unmounts and mounts it where\nthe copy was mounted. If that's where the propagated copy of the second\nvictim is looked up the overmount becomes a candidate of the second\numount_tree(). It's childless and so trim_one() commits it without\nlooking at its reference count.\n\nSo a synchronous umount pulls out a busy mount that is in use somewhere\nelse and marks it MNT_SYNC_UMOUNT while it has users:\n\n  umount2(/tmp/plshrink/p1, 0) = 0 errno 0\n  cwd is (unreachable)\n\nThe same two umounts requested one after the other fail with EBUSY.\nThis needs a mount with MNT_SHRINKABLE, i.e., automounted submounts of\nNFS, AFS and CIFS or the tracefs mount below debugfs. Bind mounts\ninherit the flag.\n\nCheck each mount right before it is unmounted under the same hold of\nnamespace_sem and mount_lock as the umount itself. Make sure that the\nalgorithm stays linear.",
  "id": "CVE-2026-98990",
  "modified": "2026-11-01T02:31:05.061751848Z",
  "published": "2026-10-23T12:20:09.349Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/18902a23ef36f83d32bafc58ae2484e6bb4bb8ef"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/32bf92416614a1e3ff3524fc6b780259c7aad3ef"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/361f59e7f3f9a219fb5567bf9abc8482a154a399"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3f55f71291e4332983cd63b288d1f2be3c9c08fc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6e4012e571867868b545c91ca9d6095fdb709907"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cda0c4e502a0f74a191471ce100fb061e5ab35d6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d73f04e92c1aab78d96ac6cadb234c8a3a373d22"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f6394281834492c6516a405a348b545ae698a331"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98990.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98990"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.2",
  "summary": "namespace: check a submount for references right before unmounting it"
}