Linux Kernel CVE-2026-98993

Requires local code execution plus the ability to create mounts and mount namespaces (CAP_SYS_ADMIN), which unprivileged users can obtain on systems where unprivileged user namespaces are enabled. The concrete trigger is stated in the sources: bind-mount an nsfs or pidfs pseudo-file (e.g. /proc/self/ns/net), hold it open on a file descriptor, lazily unmount it (umount -l), then re-bind it through /proc/self/fd/N - may_copy_tree() accepts the nsfs/pidfs source before checking whether it is still mounted, so the copy carries MNT_UMOUNT. Limiting factors: no network vector (AV:L) and no user interaction, but exploitation is gated on mount privileges - on hosts where unprivileged user namespaces are disabled, a genuine CAP_SYS_ADMIN context is needed, substantially reducing real-world reach.

Signals point to a real but non-urgent, locally-scoped kernel memory-safety bug rather than a widespread remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, 7.8 HIGH) is consistent with the description: this is a local, low-privilege use-after-free in the mount-namespace code, not a network-reachable issue. EPSS is low at 0.21% (10th percentile) and the CVE is NOT on CISA KEV (status: no), so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis' - the only references are the kernel.org stable fix commits and the NVD entry, with no PoC or exploit reference supplied. The vendor priority label is 'this_week', which is consistent with a patchable local-privilege/memory-corruption kernel flaw that should be rolled into normal fast patch cycles but is not an emergency. No SSVC decision fields (automatable, technical impact, exploitation) were supplied, so that framework cannot be applied. One contradiction to note: the input Tags label this 'Information Disclosure', but the CVSS impact is C:H/I:H/A:H and the description is a use-after-free / namespace-confusion bug that corrupts freed kernel objects - the impact profile is broader than pure information disclosure, so the tag likely understates the technical impact. CWE is N/A in the input; the UAF/confusion classification is inferred from the description text, not vendor-assigned.

A local user who can create mount namespaces bind-mounts an nsfs/pidfs pseudo-file (e.g. /proc/self/ns/net), holds it open on a file descriptor, lazily unmounts it, then re-binds it via /proc/self/fd/N; the resulting mount is attached to the namespace with MNT_UMOUNT already set and every clone inherits it, corrupting kernel mount bookkeeping and leaving a dangling pointer to a freed struct mnt_namespace that is later read. No public exploit code is identified at time of analysis. Exploitation is local-only with low complexity, but requires mount privileges (CAP_SYS_ADMIN), which unprivileged users can obtain where unprivileged user namespaces are enabled.