CVE-2026-98983
- Source
- https://cve.org/CVERecord?id=CVE-2026-98983
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98983.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-98983
- Downstream
- Published
- 2026-10-23T12:20:00Z
- Modified
- 2026-10-28T03:01:49Z
- Summary
- unshare: don't drop active namespace references that were never taken
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
unshare: don't drop active namespace references that were never taken
Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy().
But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using:
WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare
Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid.
Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98983.json" }- References
-
- https://git.kernel.org/stable/c/0b6f31a3c0b16066f812e94b52a704174a6f23cd
- https://git.kernel.org/stable/c/56fe03a0c05dba4c5f6a23c391f96de1614a098c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98983.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-98983
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceda98621a0f187a934c115dcfe79a49520ae892111Fixed56fe03a0c05dba4c5f6a23c391f96de1614a098cFixed0b6f31a3c0b16066f812e94b52a704174a6f23cd
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5.15.209Fixed5.16
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.1.175Fixed6.2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.141Fixed6.7
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.91Fixed6.13
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.18.33Fixed6.19
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7.0.10Fixed7.1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced27ae6b17c9ba7ff353ab0906297f08aa845782b4
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced297261b343371c4f0b31055d53d285138ec21565
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced813a47b0309097da71781ee4ac11922e39b67d55
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6e608e3e5ce12ce7fd21e46212eccca37f917d0e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduceda261fccdb4ac58ec5ba6aa1d92a6cc418fff301f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced665dc1ed16357988d439fc5bbc860ee36f540d81