SECURITY ANNOUNCEMENT

CVE-2026-98995

23 October 2026

do_lock_mount() takes references on whatever it finds there. So reset ->overmount of the old parent in mnt_change_mountpoint() the same way __umount_mnt() does. A mount's ->overmount is then always a

Introduced

6.17ffdc52fbbd5835a936ad683c943d6d103a2d4514

Fixed releases

6.18.575e0a1f2c753a79749bc2ead3ae2f2ede3941daa5

7.2.1108d575ee89393fd812dbdca7b5d7b4574cd5a564

7.3476ef286a7a5db8bda51325dc0c45887b4d99d9a

View source announcement ↗