CVE-2026-98982
Tenable Plugin
Checking the public Tenable catalog…
AI Threat Summary
CVE-2026-98982 is a high-severity vulnerability with a CVSS score of 7.8 affecting the target software. Threat hunters should monitor for exploit attempts and apply vendor patches immediately.
Description
In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount d_alloc_pseudo() hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHE_NORCU and dentry_free() frees them right away because no lockless path walk can ever reach them. That holds as long as such a dentry isn't the root of a mount. But bind mounting /proc/self/fd/<fd> of such a file does exactly that. Most callers of alloc_file_pseudo() put their files on kernel-internal mounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It places the token file on the bpffs mount the caller handed it and that mount is in the caller's mount namespace so the clone goes through: mount --bind /proc/self/fd/<token> <file> open_tree(tokfd, "", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount() __follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq and d_flags of the dentry and only then checks mount_lock. The dentry can be gone by then. The final mntput() of an unmounted parent unhooks a child that stayed attached to it under mount_lock alone. When the child's holder does the final put right after that the root is dput() and freed immediately while a walker that found the mount hashed still looks at it. Refuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing sensible can be done with a bind mount of a bpf token anyway.
Attack Chain
Attacker scans for vulnerable versions using version banners or PoC scanners
Attacker triggers CVE-2026-98982 vulnerability with a crafted request or payload
Vulnerability exploited to perform unauthorized actions on the target system
Depending on vulnerability type, attacker achieves data access, service disruption, or code execution
MITRE ATT&CK Techniques
Indicators of Compromise
| Type | Value | Description | |
|---|---|---|---|
| user_agent | Mozilla/5.0 (compatible; exploit/1.0) |
Generic exploit scanner user agent pattern | |
| url | /api/vuln-endpoint?payload=<malicious> |
Exploit attempt against application endpoint — monitor access logs for anomalous params |
Remediation
Quick Facts
| CVE ID | CVE-2026-98982 |
| CVSS Score | 7.8 |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Published | 2026-10-23 |
| Exploited | No |
| CISA KEV | No |
| PoC | Available |