{"id":29127,"date":"2026-09-25T20:31:56","date_gmt":"2026-09-25T12:31:56","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97971"},"modified":"2026-09-25T20:31:56","modified_gmt":"2026-09-25T12:31:56","slug":"cve-2026-97971","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97971","title":{"rendered":"CVE-2026-97971 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnstree: check listing"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nstree: check listing permission before taking a namespace reference<\/p>\n<p>legitimize_ns() takes a reference on the candidate namespace before<br \/>\nmay_list_ns() has decided whether the caller may see it. The<br \/>\n__free(ns_put) cleanup on the denied path can drop the last reference to a<br \/>\nmount namespace while we still hold the rcu read lock, and put_mnt_ns()<br \/>\nmay sleep there. This is the same problem commit 2ec2aff3c8e2 (&#8220;ns: make<br \/>\nsure reference are dropped outside of rcu lock&#8221;) fixed for the put_user()<br \/>\npath. Neither ns_requested() nor may_list_ns() needs a reference, both<br \/>\nonly look at the namespace type and at the caller&#8217;s own namespaces, so do<br \/>\nthe checks first and take the reference last.<\/p>\n<p>Splat:<\/p>\n<p>  Voluntary context switch within RCU read-side critical section!<br \/>\n  WARNING: kernel\/rcu\/tree_plugin.h:332 at rcu_note_context_switch+0x238\/0x2a0, CPU#5: a\/3442<br \/>\n  CPU: 5 UID: 1000 PID: 3442 Comm: a Not tainted 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy)<br \/>\n  RIP: 0010:rcu_note_context_switch+0x238\/0x2a0<br \/>\n  Call Trace:<\/p>\n<p>   __schedule+0xcf\/0x650<br \/>\n   schedule+0x27\/0x90<br \/>\n   schedule_preempt_disabled+0x15\/0x30<br \/>\n   __mutex_lock.constprop.0+0x550\/0xaf0<br \/>\n   __mutex_lock_slowpath+0x13\/0x20<br \/>\n   mutex_lock+0x3b\/0x50<br \/>\n   exp_funnel_lock+0xb2\/0x260<br \/>\n   synchronize_rcu_expedited+0xe7\/0x220<br \/>\n   namespace_unlock+0x26a\/0x320<br \/>\n   put_mnt_ns+0xd3\/0x120<br \/>\n   mntns_put+0xe\/0x20<br \/>\n   do_listns+0x13e\/0x560<br \/>\n   __do_sys_listns+0x126\/0x2d0<br \/>\n   __x64_sys_listns+0x20\/0x30<br \/>\n   x64_sys_call+0x2366\/0x2390<br \/>\n   do_syscall_64+0x105\/0x5a0<br \/>\n   entry_SYSCALL_64_after_hwframe+0x76\/0x7e<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>nstree: check listing permission before taking a namespace reference<\/p>\n<p>legitimize_ns() takes a reference on the candidate namespace <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29127","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}