CVE-2026-98983
Received
Received - Intake
Linux Kernel nsproxy Reference Counting Flaw
Vulnerability report for CVE-2026-98983, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-23
Last updated on: 2026-10-23
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
unshare: don't drop active namespace references that were never taken
Active references on the namespaces of an nsproxy are taken when the
nsproxy is installed into a task in switch_task_namespaces() and
copy_namespaces() and dropped again by put_nsproxy() through
deactivate_nsproxy().
But ksys_unshare() calls put_nsproxy() on an nsproxy that was never
installed when set_cred_ucounts() fails. The new namespaces of that
nsproxy go from zero to minus one and the namespaces shared with the
caller lose a reference that belongs to the nsproxy the caller keeps
using:
WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230
nsproxy_ns_active_put
deactivate_nsproxy
ksys_unshare
Afterwards the namespaces the caller lives in aren't listed by listns()
anymore. set_cred_ucounts() only fails when alloc_ucounts() can't
allocate and it only allocates when the real uid of the caller differs
from its effective uid.
Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify
create_new_namespaces()") separated the two cases on purpose.
nsproxy_free() frees an nsproxy that was prepared but never installed
and that's what a failed setns() uses in put_nsset(). Export it and use
it for a failed unshare() as well.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | a98621a0f187a934c115dcfe79a49520ae892111 |
| Linux | Linux | a98621a0f187a934c115dcfe79a49520ae892111 |
| Linux | Linux | 27ae6b17c9ba7ff353ab0906297f08aa845782b4 |
| Linux | Linux | 297261b343371c4f0b31055d53d285138ec21565 |
| Linux | Linux | 813a47b0309097da71781ee4ac11922e39b67d55 |
| Linux | Linux | 6e608e3e5ce12ce7fd21e46212eccca37f917d0e |
| Linux | Linux | a261fccdb4ac58ec5ba6aa1d92a6cc418fff301f |
| Linux | Linux | 665dc1ed16357988d439fc5bbc860ee36f540d81 |
| Linux | Linux | 5.15.209 |
| Linux | Linux | 6.1.175 |
| Linux | Linux | 6.6.141 |
| Linux | Linux | 6.12.91 |
| Linux | Linux | 6.18.33 |
| Linux | Linux | 7.0.10 |
| Linux | Linux | 7.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
