{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipc: drop the mqueue mount with kern_unmount() on setup failure  mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its -\u003emnt_ns is MNT_NS_INTERNAL. When setting up the mqueue or ipc sysctls or msg_init_ns() fails afterwards, create_ipc_ns() drops it with a plain mntput(). With -\u003emnt_ns set that takes the fast path of mntput_no_expire(). The count drops to zero and nothing ever kills the mount, so the mount and the mqueue superblock are leaked.  Commit dc55e35f9e81 (\"ipc: Store mqueue sysctls in the ipc namespace\") added the first failure path after mq_init_ns() and never dropped the mount. Commit 7229d74e5e8c (\"ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure\") tried to fix that with a mntput() but that doesn't help for a long-term mount.  Use kern_unmount(). free_ipc() open-codes the same thing for a namespace that made it.",
  "id": "DEBIAN-CVE-2026-99172",
  "modified": "2026-10-29T05:47:38.542451806Z",
  "published": "2026-10-28T11:17:37.790Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99172"
    }
  ],
  "upstream": [
    "CVE-2026-99172"
  ]
}