CVE-2026-99170: locked mount bypass in Linux kernel

Linux kernel vulnerability (CVSS 8.8) allowing locked mount bypass via namespace operations.

CVE-2026-99170 describes a vulnerability in the Linux kernel allowing an isolated root process to bypass locked mounts via copy_tree(). The defect is the failure to check the MNT_LOCKED flag during namespace operations (unshare() or clone() with CLONE_NEWNS). An attacker can move a namespace file mount beneath a locked mount and call unshare(CLONE_NEWNS) to mask files without modifying the underlying filesystem.

Severity is CVSS 8.8 (high). Coherent signals come from NVD (resolved) and X/Twitter posts confirm patch in kernel 7.2.13. No active exploits reported, but the technique is straightforward. The impact affects multitenant systems, containerized environments, and any architecture relying on namespace isolation.

For defense: update kernel to 7.2.13 as priority. Where immediate rollout is not feasible, implement controls on unshare() and clone() via seccomp or eBPF. Monitor mount logs, restrict user namespace creation privileges, and verify underlying kernels in container deployments.

At a glance

What: CVE-2026-99170: defect in Linux kernel copy_tree() function. During namespace operations (unshare, clone with CLONE_NEWNS) does not properly verify MNT_LOCKED flag on namespace file mounts. Enables bypass of protections and unmounting of sensitive data covers without modifying underlying filesystem.
Severity: CVSS 8.8 (high). A root process in isolated user namespace bypasses locked mounts and removes protections on ordinary files. Direct impact on multitenant and containerized systems.
Affected versions: Linux kernel (specific versions not detailed in official data). Patch integrated starting from kernel 7.2.13.
Fix: Refuse copy_tree() when containing locked mount of namespace file (EPERM). Refuse move_mount() of namespace file below locked mount. Introduced starting from kernel 7.2.13.
Status: Resolved. CVE published 2026-10-28. Patch confirmed in kernel 7.2.13 according to official posts.
Action: Update kernel to 7.2.13 or later. Monitor mount logs for anomalous activity. Restrict user namespace creation privileges. Implement seccomp/eBPF controls on unshare() and clone() where immediate rollout is not feasible.

Sources: NVD, CVE-2026-99170

← All articles