Is there a patch available for CVE-2026-98983?

Yes, a patch is available for CVE-2026-98983. Update the affected software to the latest version immediately.

Linux CVE-2026-98983

EUVD-2026-108777

2026-10-23 Linux

GHSA-vc4v-q632-x9g5

Information Disclosure Linux

View

Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

unshare: don't drop active namespace references that were never taken

Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy().

But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using:

WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare

Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid.

Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.

Affected VersionsENISA

Linux 6.18.33 <6.19

Linux 6.1.175 <6.2

Linux 813a47b0309097da71781ee4ac11922e39b67d55

Linux 7.1

Linux 6e608e3e5ce12ce7fd21e46212eccca37f917d0e

Linux 27ae6b17c9ba7ff353ab0906297f08aa845782b4

Linux patch: 0

Linux 6.6.141 <6.7

Linux a98621a0f187a934c115dcfe79a49520ae892111 <56fe03a0c05dba4c5f6a23c391f96de1614a098c

Linux a261fccdb4ac58ec5ba6aa1d92a6cc418fff301f

Linux 665dc1ed16357988d439fc5bbc860ee36f540d81

Linux 297261b343371c4f0b31055d53d285138ec21565

Linux 5.15.209 <5.16

Linux 7.0.10 <7.1

Linux a98621a0f187a934c115dcfe79a49520ae892111 <0b6f31a3c0b16066f812e94b52a704174a6f23cd

Linux 6.12.91 <6.13

Linux patch: 7.2.11

Linux patch: 7.3

Affected Packages

euvd linux fix: 5.16, 6.2, 6.7, 6.13, 6.19, 7.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 23, 2026 - 13:17 EUVD

CVE Published

Oct 23, 2026 - 12:20 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Data Quality

2 sources

Confidence: Low

EUVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.