Description
In the Linux kernel, the following vulnerability has been resolved:

namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE

open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a
copy of the tree at the given path. The caller needs to be privileged
over its current user namespace because the new mount namespace will be
owned by it. It doesn't need to be privileged over the mount namespace
the tree is copied from. An unprivileged user just needs to create a
user namespace first.

The copy follows the rules of a detached bind mount. Without
AT_RECURSIVE only the mount itself is cloned and its children are left
out. With AT_RECURSIVE unbindable mounts are skipped. Both is fine when
the caller has privileges over the source mount namespace because it
could unmount those mounts anyway. Not so for an unprivileged user in
that mount namespace. For them a mount namespace copy is what unshare()
does. copy_mnt_ns() copies everything including unbindable mounts and
lock_mnt_tree() makes sure nothing can be unmounted in the copy. Nothing
that was covered gets revealed.

create_new_namespace() only does the locking and so the covered content
is right there in the new mount namespace:

# mount -t tmpfs none /tmp/otn; mkdir /tmp/otn/covered
# echo hidden > /tmp/otn/covered/under.txt
# mount -t tmpfs none /tmp/otn/covered

uid 1000, after unshare(CLONE_NEWUSER):
fd = open_tree(AT_FDCWD, "/tmp/otn", OPEN_TREE_NAMESPACE);
setns(fd, CLONE_NEWNS);
open("/covered/under.txt", O_RDONLY) -> "hidden"

Covering paths with mounts is how container runtimes mask parts of
/proc and /sys and how admins hide things.

When the caller's user namespace doesn't own the source mount namespace
copy the way unshare() does and refuse a non-recursive copy of a mount
that has anything mounted below the requested directory and copy
unbindable mounts in a recursive copy. A caller that is privileged over
the source mount namespace sees no change.
Published: 2026-10-23
Score: n/a
EPSS: n/a
KEV: No
Impact: Confidentiality Exposure
Action: Immediate Patch
AI Analysis

Impact

The Linux kernel vulnerability allows an unprivileged user to create a mount namespace that copies the entire mount tree, including mounts that are normally hidden behind covering mounts. By invoking open_tree(OPEN_TREE_NAMESPACE) followed by setns(), the user can access files that should be invisible within the original namespace, thereby exposing sensitive data. The flaw manifests as improper isolation of mount namespaces rather than enabling arbitrary code execution or denial of service.

Affected Systems

The issue applies to Linux kernel versions that support open_tree() and setns() prior to the patch that introduced the correction. No specific version list is provided, so any kernel release that has not yet been updated to the fixed commit is potentially vulnerable. The vulnerability is not limited to any particular distribution but affects all standard Linux kernel installations where unprivileged users can create user namespaces.

Risk and Exploitability

The CVSS score is not supplied and the EPSS value is unavailable, but the vulnerability is not currently listed in CISA's KEV catalog. Attackers can exploit the flaw locally; by creating a user namespace and cloning the mount tree, they can read files hidden by covering mounts without needing elevated privileges. The exploit does not require network exposure and is best applied from within the same system, making it a local privilege escalation risk that leads to information disclosure.

Generated by OpenCVE AI on October 23, 2026 at 14:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that contains the fix for this vulnerability.
  • Disable unprivileged user namespaces by setting "/proc/sys/kernel/unprivileged_userns_clone" to 0 if your environment does not require them.
  • Review container or virtualization configurations to ensure that mount namespace operations are restricted and that covering mounts are properly enforced.

Generated by OpenCVE AI on October 23, 2026 at 14:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-284

Fri, 23 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE open_tree(OPEN_TREE_NAMESPACE) creates a new mount namespace from a copy of the tree at the given path. The caller needs to be privileged over its current user namespace because the new mount namespace will be owned by it. It doesn't need to be privileged over the mount namespace the tree is copied from. An unprivileged user just needs to create a user namespace first. The copy follows the rules of a detached bind mount. Without AT_RECURSIVE only the mount itself is cloned and its children are left out. With AT_RECURSIVE unbindable mounts are skipped. Both is fine when the caller has privileges over the source mount namespace because it could unmount those mounts anyway. Not so for an unprivileged user in that mount namespace. For them a mount namespace copy is what unshare() does. copy_mnt_ns() copies everything including unbindable mounts and lock_mnt_tree() makes sure nothing can be unmounted in the copy. Nothing that was covered gets revealed. create_new_namespace() only does the locking and so the covered content is right there in the new mount namespace: # mount -t tmpfs none /tmp/otn; mkdir /tmp/otn/covered # echo hidden > /tmp/otn/covered/under.txt # mount -t tmpfs none /tmp/otn/covered uid 1000, after unshare(CLONE_NEWUSER): fd = open_tree(AT_FDCWD, "/tmp/otn", OPEN_TREE_NAMESPACE); setns(fd, CLONE_NEWNS); open("/covered/under.txt", O_RDONLY) -> "hidden" Covering paths with mounts is how container runtimes mask parts of /proc and /sys and how admins hide things. When the caller's user namespace doesn't own the source mount namespace copy the way unshare() does and refuse a non-recursive copy of a mount that has anything mounted below the requested directory and copy unbindable mounts in a recursive copy. A caller that is privileged over the source mount namespace sees no change.
Title namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-23T12:20:07.483Z

Reserved: 2026-09-25T10:25:14.384Z

Link: CVE-2026-98988

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T13:17:20.753

Modified: 2026-10-23T13:17:20.753

Link: CVE-2026-98988

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T15:00:13Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control