{"metadata": {"vulnerability": "CVE-2026-98986", "count": 18, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-25T10:25:14.384Z", "date_only": false, "value": "2026-09-25T10:25:14.384Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98986", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:20:04.966Z", "date_only": false, "value": "2026-10-23T12:20:04.966Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98986", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T12:20:04.966Z", "date_only": false, "value": "2026-10-23T12:20:04.966Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98986", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T12:20:04.966Z", "date_only": false, "value": "2026-10-23T12:20:04.966Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98986", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98986", "record": "UBUNTU-CVE-2026-98986", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:20Z", "date_only": false, "value": "2026-10-23T13:17:20Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6338-GV67-39M8", "record": "GHSA-6338-GV67-39M8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-23T13:17:20.540Z", "date_only": false, "value": "2026-10-23T13:17:20.540", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98986", "record": "FKIE_CVE-2026-98986", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:20.540Z", "date_only": false, "value": "2026-10-23T13:17:20.540", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98986", "record": "FKIE_CVE-2026-98986", "field": "lastModified"}, {"timestamp": "2026-10-23T13:30:45.692Z", "date_only": false, "value": "2026-10-23T13:30:45.692736Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490466417210789", "record": "CVE-2026-98986", "field": "creation_timestamp", "uuid": "ac89903f-7af5-4536-b542-4dd94107df65", "content": "CVE-2026-98986 namespace: remove the fsnotify marks of a mount namespace in process context In the Linux kernel, the following vulnerability has been resolved:\nnamespace: remove the fsnotify marks of a mount namespace in process context\nmnt_ns_release() drops the last passive reference of a mount namespaceand removes its fanotify marks via fsnotify_mntns_delete(). That takesthe mutex of every group with a mark on the namespace and the spinlockof the connector. Fine from process context. But mnt_ns_tree_remove()hands the reference the namespace was allocated with to call_rcu() andso the marks are removed from the RCU softirq:\n  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:623  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/3   __mutex_lock+0x113/0x24b0   fsnotify_destroy_marks+0x11b/0x3d0   mnt_ns_release_rcu+0x57/0xa0   rcu_core+0x6b6/0x1e40\nand lockdep complains about the connector lock being taken from softirqcontext. A fanotify group with a FAN_MARK_MNTNS mark on the mountnamespace of another task is all that's needed. Root in a usernamespace can do that for a mount namespace it owns. The task exits andthe namespace is freed with the mark still on it.\nRemove the marks in free_mnt_ns() before the namespace is handed to RCU.That runs in process context once the last active reference is gone. Amark is added through a file descriptor to the namespace which holds anactive reference so no mark can show up after that.\nhttps://www.cve.org/CVERecord?id=CVE-2026-98986https://git.kernel.org/stable/c/888363d74c3b5d32e2accf217add70f8b38e0e2bhttps://git.kernel.org/stable/c/9e820a6becdd955a04adbedfd767253a47eedd9ehttps://git.kernel.org/stable/c/1a116222acdcc1bc1a8350727ae6f28907d44594#kernel #Linux#CVE_2026_98986#bot", "url": "https://infosec.exchange/users/cve/statuses/117490466417210789"}, {"timestamp": "2026-10-23T15:31:33Z", "date_only": false, "value": "2026-10-23T15:31:33Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6338-GV67-39M8", "record": "GHSA-6338-GV67-39M8", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T15:31:33Z", "date_only": false, "value": "2026-10-23T15:31:33Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6338-GV67-39M8", "record": "GHSA-6338-GV67-39M8", "field": "modified"}, {"timestamp": "2026-10-24T01:11:04Z", "date_only": false, "value": "2026-10-24T01:11:04.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98986", "record": "MSRC_CVE-2026-98986", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-24T01:11:04Z", "date_only": false, "value": "2026-10-24T01:11:04.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98986", "record": "MSRC_CVE-2026-98986", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-24T01:11:04Z", "date_only": false, "value": "2026-10-24T01:11:04.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98986", "record": "MSRC_CVE-2026-98986", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-24T07:00:42.702Z", "date_only": false, "value": "2026-10-24T07:00:42.702Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98986", "record": "MSRC_CVE-2026-98986", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-28T06:07:53.841Z", "date_only": false, "value": "2026-10-28T06:07:53.841927Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98986", "record": "BELL-CVE-2026-98986", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T06:31:43.536Z", "date_only": false, "value": "2026-10-28T06:31:43.536009Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98986", "record": "BELL-CVE-2026-98986", "field": "modified"}, {"timestamp": "2026-10-28T23:51:58Z", "date_only": false, "value": "2026-10-28T23:51:58Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98986", "record": "UBUNTU-CVE-2026-98986", "field": "modified"}], "metrics": {"as_of": "2026-10-29T23:44:04.874Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:20:04.966Z", "date_only": false, "value": "2026-10-23T12:20:04.966Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98986", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:20:04.966Z", "date_only": false, "value": "2026-10-23T12:20:04.966Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98986", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 559439.908273, "hours": 155.3999745202778, "days": 6.474998938344908, "min_seconds": 559439.908273, "max_seconds": 559439.908273, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:20:04.966Z", "date_only": false, "value": "2026-10-23T12:20:04.966Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98986", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T23:44:04.874Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}