Linux Kernel CVE-2026-98982

Requires LOCAL access and the ability to reach bpf_token_create() and place the token file on a bpffs mount that resides in the caller's own mount namespace - unlike other alloc_file_pseudo() callers whose files sit on kernel-internal mounts that may_copy_tree() refuses to clone. The attacker must then bind-mount /proc/self/fd/<token> and clone it (OPEN_TREE_CLONE + move_mount) so the DCACHE_NORCU dentry becomes a mount root. Limiting factors: no remote vector (local only); it depends on a configuration where a bpffs mount with BPF token delegation is usable by the attacker (not a default general-purpose setup); and successful exploitation hinges on winning the race in __follow_mount_rcu between the lockless walk and the final dput, which narrows the practical window. The complete fix is the kernel patch, which refuses to clone a mount whose root dentry is DCACHE_NORCU.

This is a Linux kernel use-after-free in mount/namespace handling (a pseudo dentry carrying DCACHE_NORCU becoming the root of a cloned mount via a bpf token bind-mount). The supplied CVSS is 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, i.e. local, low-privilege, full CIA impact. Counter-signals are strongly deflationary: EPSS is only 0.21% (11th percentile), the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present in the input - only upstream stable git commits (the fix). The vuln.today priority is 'this_week' (not act_now/emergency), consistent with a locally-exploitable memory-corruption bug that is patched but not under active exploitation. One internal tension: the input vector states AC:L, but the description explicitly frames the bug as a race between the RCU path walk (__follow_mount_rcu reading d_seq/d_flags) and the final dput()/free, which is the kind of narrow timing window that normally argues for AC:H - treat the 'low complexity' label with caution. Bottom line: a genuine local privilege-escalation/memory-corruption risk worth patching promptly, but the real-world priority is bounded by local access plus an unusual precondition (a usable bpffs mount and bpf token creation in the caller's namespace), so it is not a mass-exploitation threat.

A local, low-privileged user with access to a bpffs mount in its own mount namespace creates a BPF token file, then bind-mounts /proc/self/fd/<token> and clones that mount (open_tree with OPEN_TREE_CLONE + move_mount) so the DCACHE_NORCU pseudo dentry becomes a mount root. The attacker then races a lockless RCU path walk against the final mntput/dput so a walker dereferences the dentry after it has been freed, yielding kernel use-after-free and potential privilege escalation. No public exploit identified at time of analysis.