Is there a patch available for CVE-2026-98990?

Yes, a patch is available for CVE-2026-98990. Update the affected software to the latest version immediately.

Linux CVE-2026-98990

EUVD-2026-108784

2026-10-23 Linux

GHSA-5v88-6pxr-8v5g

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

namespace: check a submount for references right before unmounting it

shrink_submounts() and mark_mounts_for_expiry() first collect all the mounts they are allowed to unmount and then unmount them.

Whether a mount is busy is decided by propagate_mount_busy() on the tree. But unmounting the first mount changes the tree that the second one propagates into. propagate_umount() moves a surviving overmount off a copy it unmounts and mounts it where the copy was mounted. If that's where the propagated copy of the second victim is looked up the overmount becomes a candidate of the second umount_tree(). It's childless and so trim_one() commits it without looking at its reference count.

So a synchronous umount pulls out a busy mount that is in use somewhere else and marks it MNT_SYNC_UMOUNT while it has users:

umount2(/tmp/plshrink/p1, 0) = 0 errno 0 cwd is (unreachable)

The same two umounts requested one after the other fail with EBUSY. This needs a mount with MNT_SHRINKABLE, i.e., automounted submounts of NFS, AFS and CIFS or the tracefs mount below debugfs. Bind mounts inherit the flag.

Check each mount right before it is unmounted under the same hold of namespace_sem and mount_lock as the umount itself. Make sure that the algorithm stays linear.

Affected VersionsENISA

Linux 1064f874abc0d05eeed8993815f584d847b72486 <32bf92416614a1e3ff3524fc6b780259c7aad3ef

Linux 1064f874abc0d05eeed8993815f584d847b72486 <18902a23ef36f83d32bafc58ae2484e6bb4bb8ef

Linux patch: 7.2.11

Linux 6de9d08a9718ee9c12ba6343c50141c2d633e3dc

Linux 808e83e5add13152bd4a88346487de68395c136b

Linux patch: 0

Linux 4.4.54 <4.5

Linux 4.9.15 <4.10

Linux 4.1.40 <4.2

Linux 4.11

Linux patch: 6.12.113

Linux patch: 6.18.57

Linux patch: 7.3

Linux patch: 6.6.160

Linux 1064f874abc0d05eeed8993815f584d847b72486 <f6394281834492c6516a405a348b545ae698a331

Linux 1064f874abc0d05eeed8993815f584d847b72486 <d73f04e92c1aab78d96ac6cadb234c8a3a373d22

Linux 839d42687dfce0ed0ea2c6bd8d707cc0e276fbe7

Linux 1064f874abc0d05eeed8993815f584d847b72486 <6e4012e571867868b545c91ca9d6095fdb709907

Linux 4.10.3 <4.11

Linux 5e6ef5ef6eaf690faad3a7c6c665ebf45d7b6ccf

Affected Packages

euvd linux fix: 4.2, 4.5, 4.10, 4.11

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 23, 2026 - 13:17 EUVD

CVE Published

Oct 23, 2026 - 12:20 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.