8.8 High

In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copytree() leaves out can't take over a lock…

CVE-2026-99170

In the Linux kernel, the following vulnerability has been resolved: namespace: a mount that copytree() leaves out can't take over a lock Since commit c62a4766937e ("movemount: transfer MNTLOCKED") a mount can be moved beneath a locked mount. The lock moves from the old cover to the new mount which takes over the job of hiding what's under it and the old cover can be unmounted. That works as long as the new mount stays. But the caller picks the new mount and copytree() leaves a mount of a mount namespace file out of every copy made without CLCOPYMNTNSFILE, together with everything mounted on it, and never looks at MNTLOCKED. unshare(CLONENEWNS) and mount propagation make such copies. So a task that is root in its own user namespace gets rid of a locked cover on a file without a race and without touching the filesystem below it. It makes a child with a mount namespace of its own, binds the child's /proc/ /ns/mnt beneath the cover with MOVEMOUNTBENEATH, which hands the lock to that bind, and calls unshare(CLONENEWNS). The new mount namespace has nothing on the file. That's the usual way to mask a single file, a bind of /dev/null or of an empty file. With a bind of an ordinary file…

Assessment

CVSS: 8.8 (v3.1)
Severity: High
EPSS: 0.16% chance of exploitation in the next 30 days
Known exploited: Not listed in CISA KEV
Exploit availability: Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
Published: 28 October 2026
Last updated: 31 October 2026
Affected: Linux
Assigner: Linux

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

At the source

EUVD (ENISA)

References

Community proofs of concept

No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.

Submit a proof of concept

Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.

Title *

Proof of concept *

Write-up (optional)

Affected versions (optional)

Name or handle (optional)

References (optional, one URL per line)

Licence for your contribution *

Private contact (optional, never shown)

Before you submit * This vulnerability is already publicly disclosed (it has a published CVE). This material comes only from testing I was authorised to perform. I have the legal right to publish this content and am not breaching any agreement by doing so. It contains no live credentials, personal data, or anything targeting systems I am not authorised to test. I understand it will be reviewed before it appears publicly and may be rejected. I agree to the submission terms.

What is 3 + 5? *

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2026-99170