{"metadata": {"vulnerability": "CVE-2026-99170", "count": 23, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 15}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-25T10:25:14.398Z", "date_only": false, "value": "2026-09-25T10:25:14.398Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99170", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-28T10:35:25.923Z", "date_only": false, "value": "2026-10-28T10:35:25.923Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99170", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T11:17:00Z", "date_only": false, "value": "2026-10-28T11:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99170", "record": "UBUNTU-CVE-2026-99170", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:17:37Z", "date_only": false, "value": "2026-10-28T11:17:37Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-FV9W-C66R-MFVR", "record": "GHSA-FV9W-C66R-MFVR", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-28T11:17:37.520Z", "date_only": false, "value": "2026-10-28T11:17:37.520", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99170", "record": "FKIE_CVE-2026-99170", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T11:31:00.691Z", "date_only": false, "value": "2026-10-28T11:31:00.691518Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117518307141364163", "record": "CVE-2026-99170", "field": "creation_timestamp", "uuid": "27dc1a9c-5f9d-4416-ade1-883ae5d75e09", "content": "CVE-2026-99170 namespace: a mount that copy_tree() leaves out can't take over a lock In the Linux kernel, the following vulnerability has been resolved:\nnamespace: a mount that copy_tree() leaves out can't take over a lock\nSince commit c62a4766937e (\"move_mount: transfer MNT_LOCKED\") a mountcan be moved beneath a locked mount. The lock moves from the old coverto the new mount which takes over the job of hiding what's under it andthe old cover can be unmounted. That works as long as the new mountstays. But the caller picks the new mount and copy_tree() leaves amount of a mount namespace file out of every copy made withoutCL_COPY_MNT_NS_FILE, together with everything mounted on it, and neverlooks at MNT_LOCKED. unshare(CLONE_NEWNS) and mount propagation makesuch copies.\nSo a task that is root in its own user namespace gets rid of a lockedcover on a file without a race and without touching the filesystembelow it. It makes a child with a mount namespace of its own, binds thechild's /proc/<pid>/ns/mnt beneath the cover with MOVE_MOUNT_BENEATH,which hands the lock to that bind, and calls unshare(CLONE_NEWNS). Thenew mount namespace has nothing on the file. That's the usual way tomask a single file, a bind of /dev/null or of an empty file. With abind of an ordinary file the file stays covered.\ncopy_tree() already refuses to leave out a locked unbindable mount with-EPERM since commit df7342b24018 (\"mount: Don't allow copyingMNT_UNBINDABLE|MNT_LOCKED mounts\"). Do the same for a locked mount of amount namespace file. That also covers a tree copied withCL_COPY_MNT_NS_FILE and attached into a mount namespace of another usernamespace where lock_mnt_tree() locks it. Note that unshare(CLONE_NEWNS)and clone(CLONE_NEWNS) fail with EPERM from such a mount namespace fromthen on. The mount can't be left out and it can't be unmounted.\nAnd refuse to move a mount of a mount namespace file beneath a lockedmount in the first place. Otherwise the task ends up with a mount itcan't unmount and an unshare() that fails for good.\nChris also found a second mount that goes away by itself, a clone of anautomounted mount that shrink_submounts() took along with its parent.Commit f78ddcc87224 (\"namespace: never expire a locked mount\") tookcare of that one.\nChris's reproducer is appended. Mode nsfile reads SECRET after theunshare() on 7.3-rc7, with this patch the move_mount() fails withEINVAL and the file stays covered. nsfile-control uses an ordinary fileand reads MASK both ways.\n  // SPDX-License-Identifier: GPL-2.0  /*   * Get rid of a locked cover with MOVE_MOUNT_BENEATH.   *   * The \"admin\" (root) makes a tmpfs W:   *     W/D         file, holds SECRET, covered by a bind of a file with MASK   *     W/Dd/inner  file, holds SECRET, Dd is covered by a bind of a directory   *                 whose \"inner\" holds MASK   *     W/own       directory of uid 1000 with the file \"mine\" and the   *                 directory \"minedir\", whose \"inner\" holds MINE   *     W/dbg       debugfs, mode 755. dbg/tracing is an automount point   * The \"attacker\" is uid 1000. It enters a new user namespace with a new mount   * namespace, so W and both covers are locked there.   *   * usage: prog MODE   *   plain      put a bind of own/mine beneath the cover of D, unmount the cover   *   nsfile     put a bind of the mount namespace file of a child beneath the   *              cover of D, then unshare(CLONE_NEWNS)   *   nsfile-control    the same with a bind of own/mine   *   shrink     put a bind of the automounted tracefs beneath the cover of Dd,   *              unmount the cover, put a tmpfs beneath W, call umount(W), which fails   *   shrink-control    the same with a bind of own/minedir   * The environment variable AUTOMOUNT_DIR names another automount point for \"shrink\".   */  #define _GNU_SOURCE  #include <errno.h>  #include <fcntl.h>  #include <grp.h>  #include <sched.h>  #include <signal.h>  #include <stdio.h>  #include <stdlib.h>  #include <string.h>  #include <unistd.h> ---truncated---\nhttps://www.cve.org/CVERecord?id=CVE-2026-99170https://git.kernel.org/stable/c/bd71d33923b9d6216bcee44331dd37142b0a8441https://git.kernel.org/stable/c/69fbe94f80bc423613fa18dae6656757423732a2#kernel #Linux#CVE_2026_99170#bot", "url": "https://infosec.exchange/users/cve/statuses/117518307141364163"}, {"timestamp": "2026-10-28T12:31:06Z", "date_only": false, "value": "2026-10-28T12:31:06Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-FV9W-C66R-MFVR", "record": "GHSA-FV9W-C66R-MFVR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "vulnerabilities.69.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T06:06:43.934Z", "date_only": false, "value": "2026-10-30T06:06:43.934457Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99170", "record": "BELL-CVE-2026-99170", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T06:35:40.277Z", "date_only": false, "value": "2026-10-30T06:35:40.277560Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99170", "record": "BELL-CVE-2026-99170", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T06:35:40.277Z", "date_only": false, "value": "2026-10-30T06:35:40.277560Z", "kind": "other", "label": "Withdrawn", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99170", "record": "BELL-CVE-2026-99170", "field": "withdrawn", "linked_record": true}, {"timestamp": "2026-10-31T12:44:35.158Z", "date_only": false, "value": "2026-10-31T12:44:35.158Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99170", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-31T12:44:35.158Z", "date_only": false, "value": "2026-10-31T12:44:35.158Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99170", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-31T13:17:58.570Z", "date_only": false, "value": "2026-10-31T13:17:58.570", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99170", "record": "FKIE_CVE-2026-99170", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-31T15:30:23Z", "date_only": false, "value": "2026-10-31T15:30:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-FV9W-C66R-MFVR", "record": "GHSA-FV9W-C66R-MFVR", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-02T23:00:00Z", "date_only": false, "value": "2026-11-02T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-11-05T23:00:00Z", "date_only": false, "value": "2026-11-05T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-10T23:00:00Z", "date_only": false, "value": "2026-11-10T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-11T01:36:23Z", "date_only": false, "value": "2026-11-11T01:36:23Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99170", "record": "UBUNTU-CVE-2026-99170", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-11T11:32:14.044Z", "date_only": false, "value": "2026-11-11T11:32:14.044+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4224", "record": "WID-SEC-W-2026-4224", "field": "document.tracking.generator.date", "linked_record": true}], "metrics": {"as_of": "2026-11-11T19:13:06.918Z", "anchors": {"origin": {"timestamp": "2026-10-28T10:35:25.923Z", "date_only": false, "value": "2026-10-28T10:35:25.923Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99170", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T10:35:25.923Z", "date_only": false, "value": "2026-10-28T10:35:25.923Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99170", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1240660.995347, "hours": 344.62805426305556, "days": 14.359502260960648, "min_seconds": 1240660.995347, "max_seconds": 1240660.995347, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T10:35:25.923Z", "date_only": false, "value": "2026-10-28T10:35:25.923Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99170", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T19:13:06.918Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}