{"metadata": {"vulnerability": "CVE-2026-98993", "count": 22, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 14}}, "data": [{"timestamp": "2026-09-25T10:25:14.384Z", "date_only": false, "value": "2026-09-25T10:25:14.384Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98993", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:20:12.266Z", "date_only": false, "value": "2026-10-23T12:20:12.266Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98993", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98993", "record": "UBUNTU-CVE-2026-98993", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:21Z", "date_only": false, "value": "2026-10-23T13:17:21Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-53W5-4V27-R5F4", "record": "GHSA-53W5-4V27-R5F4", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:21.410Z", "date_only": false, "value": "2026-10-23T13:17:21.410", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98993", "record": "FKIE_CVE-2026-98993", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:35:26.783Z", "date_only": false, "value": "2026-10-23T13:35:26.783114Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490484922907118", "record": "CVE-2026-98993", "field": "creation_timestamp", "uuid": "4fc02084-6177-46ae-b8ec-fbe752f2adfc", "content": "CVE-2026-98993 namespace: don't inherit MNT_UMOUNT in clone_mnt() In the Linux kernel, the following vulnerability has been resolved:\nnamespace: don't inherit MNT_UMOUNT in clone_mnt()\nMNT_UMOUNT gets raised on a mount that umount_tree() or umount_one() hastaken out of its namespace. It's never cleared. __detach_mounts()unhooks a mount that carries it instead of unmounting it.\ndisconnect_mount() lets an unmounted child stay attached only if itsparent carries it. propagate_umount() takes it as the sign that a mountis going to be unmounted when it decides what else can be unmounted,where a chain of locked mounts ends and where a for reparenting anovermount.\nclone_mnt() copies the flags of the source and only masksMNT_INTERNAL_FLAGS which doesn't include MNT_UMOUNT. A mount that waslazily unmounted but is kept alive by a file descriptor can still becopied when its root is an nsfs or pidfs file because may_copy_tree()accepts those before checking whether the source is mounted at all:\n  mount --bind /proc/self/ns/net /tmp/x  exec 3< /tmp/x  umount -l /tmp/x  mount --bind /proc/self/fd/3 /tmp/y\nThe mount on /tmp/y is attached to the caller's namespace withMNT_UMOUNT already set and every copy of it inherits the flag again.\nThat causes a number of bugs:\n- Unlink its mountpoint from a mount namespace where it isn't one.  __detach_mounts() takes it for a mount that was unmounted earlier,  unhooks it from its parent and drops the reference the namespace  holds on it. It stays in the namespace with one reference too few  and as its own parent, so it can't be unmounted through the file  descriptor anymore and the namespace never finds it again. When the  namespace goes away it's leaked and points to a freed struct  mnt_namespace that may_change_propagation() and anon_ns_root() read  on the next propagation change or mount_setattr() through the file  descriptor.\n- Make it shared and unmount a peer. trace_transfers() follows the  flag from the peer into it and strips it from its peer group.\n- Let a propagated umount reach it. gather_candidates() marks it with  T_UMOUNT_CANDIDATE but never puts it on the candidate list, so the  mark is never cleared and every later propagated umount skips it. If  it's the parent of a locked mount handle_locked() takes it as the  cutoff and commits the locked child that should have stayed and  disconnect_mount() leaves that child attached to it, unmounted under  a mounted parent, which is what disconnect_mount() exists to  prevent. When the namespace goes away umount_tree() visits the child  a second time. And once __detach_mounts() has made it its own parent  reparent() never finds the end of the chain of unmounted parents.\nA clone is a new mount that has never been unmounted. Add MNT_UMOUNTto MNT_INTERNAL_FLAGS so clone_mnt() never copies it. And warn whenumount_tree() reaches a mount that already has it set.\nhttps://www.cve.org/CVERecord?id=CVE-2026-98993https://git.kernel.org/stable/c/99698cfa34e493fc091219056aae446fe9442a96https://git.kernel.org/stable/c/c26c1a91ad2881a194f7af543e0b57f0870006b2https://git.kernel.org/stable/c/eecc9cd0fc07dba3f7fb0b2f844b4029435a2f7bhttps://git.kernel.org/stable/c/5077b52e9e4d72da53c50251296b99cd416765a1https://git.kernel.org/stable/c/e2c6d326216642011da318b9edfd5d57ebd5a56f#kernel #Linux#CVE_2026_98993#bot", "url": "https://infosec.exchange/users/cve/statuses/117490484922907118"}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-53W5-4V27-R5F4", "record": "GHSA-53W5-4V27-R5F4", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:03:01Z", "date_only": false, "value": "2026-10-25T01:03:01.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98993", "record": "MSRC_CVE-2026-98993", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:03:01Z", "date_only": false, "value": "2026-10-25T01:03:01.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98993", "record": "MSRC_CVE-2026-98993", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:03:01Z", "date_only": false, "value": "2026-10-25T01:03:01.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98993", "record": "MSRC_CVE-2026-98993", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-26T01:04:10Z", "date_only": false, "value": "2026-10-26T01:04:10.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98993", "record": "MSRC_CVE-2026-98993", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-26T14:45:41Z", "date_only": false, "value": "2026-10-26T14:45:41.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98993", "record": "MSRC_CVE-2026-98993", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:54.287Z", "date_only": false, "value": "2026-10-28T06:07:54.287139Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98993", "record": "BELL-CVE-2026-98993", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T12:40:47.019Z", "date_only": false, "value": "2026-10-30T12:40:47.019Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98993", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:40:47.019Z", "date_only": false, "value": "2026-10-30T12:40:47.019Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98993", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:34.713Z", "date_only": false, "value": "2026-10-30T13:21:34.713", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98993", "record": "FKIE_CVE-2026-98993", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T15:34:14Z", "date_only": false, "value": "2026-10-30T15:34:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-53W5-4V27-R5F4", "record": "GHSA-53W5-4V27-R5F4", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T19:03:28Z", "date_only": false, "value": "2026-10-30T19:03:28Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98993", "record": "UBUNTU-CVE-2026-98993", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T15:03:04Z", "date_only": false, "value": "2026-11-01T15:03:04.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98993", "record": "MSRC_CVE-2026-98993", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-01T15:03:04Z", "date_only": false, "value": "2026-11-01T15:03:04.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98993", "record": "MSRC_CVE-2026-98993", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-02T08:02:48.148Z", "date_only": false, "value": "2026-11-02T08:02:48.148Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98993", "record": "MSRC_CVE-2026-98993", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-03T20:04:07.335Z", "date_only": false, "value": "2026-11-03T20:04:07.335163Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98993", "record": "BELL-CVE-2026-98993", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-04T14:54:27.671Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:20:12.266Z", "date_only": false, "value": "2026-10-23T12:20:12.266Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98993", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:20:12.266Z", "date_only": false, "value": "2026-10-23T12:20:12.266Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98993", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1046055.405058, "hours": 290.57094584944446, "days": 12.107122743726851, "min_seconds": 1046055.405058, "max_seconds": 1046055.405058, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:20:12.266Z", "date_only": false, "value": "2026-10-23T12:20:12.266Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98993", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-04T14:54:27.671Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}