{"metadata": {"vulnerability": "CVE-2026-98996", "count": 22, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 14}}, "data": [{"timestamp": "2026-09-25T10:25:14.384Z", "date_only": false, "value": "2026-09-25T10:25:14.384Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98996", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:20:15.188Z", "date_only": false, "value": "2026-10-23T12:20:15.188Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98996", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:20:15.188Z", "date_only": false, "value": "2026-10-23T12:20:15.188Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98996", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:20:15.188Z", "date_only": false, "value": "2026-10-23T12:20:15.188Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98996", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98996", "record": "UBUNTU-CVE-2026-98996", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:21Z", "date_only": false, "value": "2026-10-23T13:17:21Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5J2W-V2XC-M3R3", "record": "GHSA-5J2W-V2XC-M3R3", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:21.770Z", "date_only": false, "value": "2026-10-23T13:17:21.770", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98996", "record": "FKIE_CVE-2026-98996", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:21.770Z", "date_only": false, "value": "2026-10-23T13:17:21.770", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98996", "record": "FKIE_CVE-2026-98996", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-23T13:37:28.016Z", "date_only": false, "value": "2026-10-23T13:37:28.016037Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490492857624834", "record": "CVE-2026-98996", "field": "creation_timestamp", "uuid": "d49ed72d-6a21-4e1e-826c-c19e4c843d78", "content": "CVE-2026-98996 fs: don't silently unmount busy mounts In the Linux kernel, the following vulnerability has been resolved:\nfs: don't silently unmount busy mounts\nThe propagate_mount_busy() helper exists to decide whether a synchronouscan suceed. It does that by looking at the copies of the victims in themounts its parent propagates to. One of those functions from propagationhell.\nIt skips a copy that has child mounts except for the case of a singlechild mount covering the copy's root. That algorithm used to be exact.It isn't anymore.\nOriginally only childless copies were unmounted during propagation.And 1064f874abc0 (\"mnt: Tuck mounts under others instead of creatingshadow/side mounts.\") ended up adding covered mounts to both sides inone go.\nAlong came 99b19d16471e (\"mnt: In propgate_umount handle visiting mountsin any order\") and that started to unmount more than before:\n[1]: A copy of a mount is unmounted when each of its children is either     its overmount or a copy of the victim itself. In the former case     the overmount gets reparented. In the latter case the copy of the     victim will end up being unmounted.\nSo propagate_umount() ended up being rewritten without adjustingpropagate_mount_busy(). And currently propagate_mount_busy() doesn'tlook at copies of the victim that have two or more children nor a singlechild that is not the overmount.\nSo any such copy in [1] is not checked forreferences. The result is that a synchronous unmount succeeds, pullingout a mount that is still in use.\nA container can run into this with its own mounts. The host shares atree with the container and the host has a mount in that tree:\n  mount -t tmpfs none /mnt  mount --make-shared /mnt  mount -t tmpfs none /mnt/a\nThe container's /mnt is a slave copy of the host mount. The containernow takes a detached copy of the tree and mounts that copy beneath itspropagated copy of /mnt/a and keeps the file descriptor to the treeopen:\n  unshare -m --propagation unchanged  mount --make-rslave /  fd = open_tree(AT_FDCWD, \"/mnt\", OPEN_TREE_CLONE | AT_RECURSIVE)  move_mount(fd, \"\", AT_FDCWD, \"/mnt/a\", MOVE_MOUNT_BENEATH)\n  grep /mnt /proc/self/mountinfo  775 355 ... /mnt ...     master:646  777 775 ... /mnt/a ...   master:646  776 777 ... /mnt/a ...   master:647  778 777 ... /mnt/a/a ... master:647\nThe now attached tree (777) is now mounted beneath the container's copyof /mnt/a. That's also where the host mount sits (as seen from the hostmount namespace). So the propagated copy (776) of the host's mount is ontop of its root and the copy of that (778) is inside it. Now the hostruns:\n  umount /mnt/a\nand it succeeds. The moved tree tree and the copy inside of it are gonefrom the container. Now only the propagated copy is left and it gotreparented to where it was before:\n  grep /mnt /proc/self/mountinfo  775 355 ... /mnt ... master:646  776 775 ... /mnt/a ...\nBut the file descriptor still refers to the moved tree. So a synchronousumount detached a mount that is still in use.\nTeach propagate_mount_busy() the same checks that propagate_umount()does. It now checks for a single victim mount without childrenfor which it can assume that MNT_LOCKED is cleared on every copy likepropagate_umount() does. The copies form chains. IOW, when a copy itselfreceives propagation from the victim's parent then the mount at the samemountpoint inside that copy is a copy as well. Whether a mount receivespropagation from the victim's can simply be checked by walking itsmasters. Walk each chain once from its top so we are sure that nestedcopies stay linear. Check every reference once of every copy that getsunmounted.\nhttps://www.cve.org/CVERecord?id=CVE-2026-98996https://git.kernel.org/stable/c/bf2c8dec26fb792876b5e9bde7030c45d8be3908https://git.kernel.org/stable/c/a210ac218c307513d43e98a08f23c2dfbeeebc2fhttps://git.kernel.org/stable/c/6857e209015f95be7a8f19a9cd5dac345b9b9859#kernel #Linux#CVE_2026_98996#bot", "url": "https://infosec.exchange/users/cve/statuses/117490492857624834"}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5J2W-V2XC-M3R3", "record": "GHSA-5J2W-V2XC-M3R3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T15:31:34Z", "date_only": false, "value": "2026-10-23T15:31:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5J2W-V2XC-M3R3", "record": "GHSA-5J2W-V2XC-M3R3", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-25T01:03:03Z", "date_only": false, "value": "2026-10-25T01:03:03.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98996", "record": "MSRC_CVE-2026-98996", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:03:03Z", "date_only": false, "value": "2026-10-25T01:03:03.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98996", "record": "MSRC_CVE-2026-98996", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:03:03Z", "date_only": false, "value": "2026-10-25T01:03:03.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98996", "record": "MSRC_CVE-2026-98996", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-26T01:04:15Z", "date_only": false, "value": "2026-10-26T01:04:15.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98996", "record": "MSRC_CVE-2026-98996", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-26T14:45:46Z", "date_only": false, "value": "2026-10-26T14:45:46.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98996", "record": "MSRC_CVE-2026-98996", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:54.508Z", "date_only": false, "value": "2026-10-28T06:07:54.508180Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98996", "record": "BELL-CVE-2026-98996", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T06:31:44.225Z", "date_only": false, "value": "2026-10-28T06:31:44.225188Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98996", "record": "BELL-CVE-2026-98996", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T19:03:29Z", "date_only": false, "value": "2026-10-30T19:03:29Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98996", "record": "UBUNTU-CVE-2026-98996", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T15:03:08Z", "date_only": false, "value": "2026-11-01T15:03:08.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98996", "record": "MSRC_CVE-2026-98996", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-01T15:03:08Z", "date_only": false, "value": "2026-11-01T15:03:08.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98996", "record": "MSRC_CVE-2026-98996", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-02T08:02:48.149Z", "date_only": false, "value": "2026-11-02T08:02:48.149Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98996", "record": "MSRC_CVE-2026-98996", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-05T18:05:00.487Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:20:15.188Z", "date_only": false, "value": "2026-10-23T12:20:15.188Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98996", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:20:15.188Z", "date_only": false, "value": "2026-10-23T12:20:15.188Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98996", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1143885.299676, "hours": 317.7459165766666, "days": 13.239413190694444, "min_seconds": 1143885.299676, "max_seconds": 1143885.299676, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:20:15.188Z", "date_only": false, "value": "2026-10-23T12:20:15.188Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98996", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T18:05:00.487Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}