CVE-2026-98983

In the Linux kernel, the following vulnerability has been resolved:

unshare: dont drop active namespace references that were never taken

Active references on the namespaces of an nsproxy are taken when the nsproxy is installed into a task in switch_task_namespaces() and copy_namespaces() and dropped again by put_nsproxy() through deactivate_nsproxy().

But ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. The new namespaces of that nsproxy go from zero to minus one and the namespaces shared with the caller lose a reference that belongs to the nsproxy the caller keeps using:

WARNING: kernel/nscommon.c:171 at __ns_ref_active_put+0x1cd/0x230 nsproxy_ns_active_put deactivate_nsproxy ksys_unshare

Afterwards the namespaces the caller lives in arent listed by listns() anymore. set_cred_ucounts() only fails when alloc_ucounts() cant allocate and it only allocates when the real uid of the caller differs from its effective uid.

Commit cefd55bd2159 (nsproxy: fix free_nsproxy() and simplify create_new_namespaces()) separated the two cases on purpose. nsproxy_free() frees an nsproxy that was prepared but never installed and thats what a failed setns() uses in put_nsset(). Export it and use it for a failed unshare() as well.

Affected Software

References

• https://git.kernel.org/stable/c/0b6f31a3c0b16066f812e94b52a704174a6f23cd
• https://git.kernel.org/stable/c/56fe03a0c05dba4c5f6a23c391f96de1614a098c