CVE-2026-98983: unshare: don't drop active namespace references that were never taken

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-23 · updated 2026-10-23

Description

In the Linux kernel, the following vulnerability has been resolved: unshare: don't drop active namespace references that were never taken Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy(). But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using: WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid. Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.

Affected products

Linux kernel: from 5.15.209 before 5.16; from 6.1.175 before 6.2; from 6.6.141 before 6.7; from 6.12.91 before 6.13; from 6.18.33 before 6.19; from 7.0.10 before 7.1 — fixed in 5.16, 6.13, 6.19, 6.2, 6.7, 7.1

How to fix

Upgrade to a fixed version: Linux kernel 5.16, 6.13, 6.19, 6.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98983 or the next vulnerability affects your stack