CVE-2026-98983
Description
In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy(). But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using: WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid. Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.
How to fix
- Linux Linux56fe03a0c05dba4c5f6a23c391f96de1614a098c, 0b6f31a3c0b16066f812e94b52a704174a6f23cd, 5.16, 6.2, 6.7, 6.13, 6.19, 7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | a98621a0f187a934c115dcfe79a49520ae892111 ≤ v < 56fe03a0c05dba4c5f6a23c391f96de1614a098c, a98621a0f187a934c115dcfe79a49520ae892111 ≤ v < 0b6f31a3c0b16066f812e94b52a704174a6f23cd, 27ae6b17c9ba7ff353ab0906297f08aa845782b4, 297261b343371c4f0b31055d53d285138ec21565, 813a47b0309097da71781ee4ac11922e39b67d55, 6e608e3e5ce12ce7fd21e46212eccca37f917d0e, a261fccdb4ac58ec5ba6aa1d92a6cc418fff301f, 665dc1ed16357988d439fc5bbc860ee36f540d81, 5.15.209 ≤ v < 5.16, 6.1.175 ≤ v < 6.2, 6.6.141 ≤ v < 6.7, 6.12.91 ≤ v < 6.13, 6.18.33 ≤ v < 6.19, 7.0.10 ≤ v < 7.1, 7.1 | 56fe03a0c05dba4c5f6a23c391f96de1614a098c, 0b6f31a3c0b16066f812e94b52a704174a6f23cd, 5.16, 6.2, 6.7, 6.13, 6.19, 7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.