Linux Kernel CVE-2026-98988

Requires local access as an unprivileged user on a kernel that permits unprivileged user-namespace creation (unshare(CLONE_NEWUSER)); the attacker then uses open_tree with OPEN_TREE_NAMESPACE. Disclosure is only meaningful where a directory has something mounted over it to hide content - specifically the covered/overmounted masking that container runtimes apply to parts of /proc and /sys, or that admins use to hide paths. Limiting factors: no remote vector (AV:L); it yields nothing on systems without such covering mounts; a caller already privileged over the source mount namespace sees no change; and hosts that disable unprivileged user namespaces remove the unprivileged path entirely.

The input CVSS of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) overstates this flaw: the description, the CWE-less 'Information Disclosure' tag, and the mechanism all indicate a pure confidentiality issue - open_tree(OPEN_TREE_NAMESPACE) copying a mount tree without the locking that unshare()/copy_mnt_ns() applies, so content previously hidden by covered (overmounted) directories becomes readable. There is no evidence of integrity or availability loss, so the I:H/A:H components appear inflated and should be treated as C-only. The attack is strictly local (AV:L) and requires an unprivileged user to first create a user namespace, i.e. a real local foothold, matching PR:L. Exploitation-likelihood signals are low and consistent with each other: EPSS 0.20% (9th percentile), no CISA KEV listing, and no public exploit referenced. The vendor priority label is 'this_week' and a fix is available via two stable-kernel commits, so this warrants scheduled patching rather than emergency response. The practical risk is concentrated in multi-tenant/container hosts where runtimes rely on covering mounts to mask parts of /proc and /sys - there the disclosure can defeat an intended isolation control.

On a shared container or multi-tenant Linux host, a local unprivileged user creates a user namespace and then calls open_tree(path, OPEN_TREE_NAMESPACE) to clone a mount tree; because the copy is not locked the way unshare() locks it, directories that a runtime or admin had masked with an overmount are revealed, and the user reads the files underneath (e.g. masked /proc or /sys entries). No cataloged public exploit exists, but the CVE description itself embeds a minimal reproducer demonstrating the read of a 'hidden' file.