Linux kernel vulnerability affects widely deployed OS kernels and containers; could meaningfully disrupt systems and appear broadly in IT/security news.
CVE-2026-98978
Linux kernel bug exposes locked mounts, revealing hidden files
Is CVE-2026-98978 being exploited?
Not confirmed. CVE-2026-98978 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.17% probability of exploitation in the next 30 days.
How severe is CVE-2026-98978?
CVE-2026-98978 is rated High with a CVSS score of 8.4. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-98978?
Yes. A fix has been recorded for CVE-2026-98978. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-98978 affect?
CVE-2026-98978 affects Linux kernel (mount subsystem), Linux containers using user namespaces. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-98978?
Apply vendor kernel updates or upstream patches immediately and reboot affected hosts
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Local attacker with user-namespace privileges can force locked mounts to expire/unmount and read hidden files; may aid container escape or data disclosure.
Immediate action required
- affected>= 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942 and < 6b8dc3713a76346d212abab46cbfc8d7070f534c
- affected>= 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942 and < d23265a12e4991ce7aedce670c0b6b598cadb644
- affected>= 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942 and < f78ddcc872248c7aa1d7e904928441a0be4c6d5d
- affected3.12
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.