CVE-2026-98983 unshare: don't drop active namespace references that were never taken
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-98983?
CVE-2026-98983 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
unshare: don't drop active namespace references that were never taken
Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy().
But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using:
WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare
Afterwards the namespaces the caller lives in aren't listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() can't allocate and it only allocates when the real uid of the caller differs from its effective uid.
Commit cefd55bd2159 ("nsproxy: fix free_nsproxy() and simplify create_new_namespaces()") separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and that's what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.
Which versions are affected by CVE-2026-98983?
How do I fix CVE-2026-98983?
Upgrade to a fixed version.
Is CVE-2026-98983 being exploited?
There is no known exploitation of CVE-2026-98983 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98983, DEBIAN-CVE-2026-98983, GHSA-vc4v-q632-x9g5, UBUNTU-CVE-2026-98983.