Executive brief
A vulnerability exists in the Linux kernel's 'unshare' system call, which is used to isolate process resources like file systems and namespaces. Under specific conditions, if the system call fails due to a memory error, it can leave a process in a broken state where its working directory and root directory point to detached, inaccessible locations. This can disrupt normal operations for the affected process and potentially lead to a denial of service for specific system tasks.
Technical details
A logic error in unshare_fs() fails to force the allocation of a new fs_struct when CLONE_NEWNS is requested but the current fs_struct is not shared (users == 1). If a subsequent operation like copy_cgroup_ns() fails (e.g., due to -ENOMEM) after copy_mnt_ns() has already modified the current fs_struct's root and pwd, the mount namespace is destroyed but the process's filesystem pointers remain attached to the now-dissolved mount tree. This leaves the process in an inconsistent state with its filesystem root and working directory pointing to detached mounts. The fix ensures a new fs_struct is always allocated when CLONE_NEWNS is specified.
Affected products
- Linux Linux Kernel from 2.6.16 up to 6.19.9
Timeline
- 2026-02-07: other: Vulnerability fixed in upstream source code by Al Viro
- 2026-05-08: advisory: CVE-2026-43472 published
References
- https://git.kernel.org/stable/c/42e21e74061b0ebbd859839f81acf10efad02a27
- https://git.kernel.org/stable/c/6c4b2243cb6c0755159bd567130d5e12e7b10d9f
- https://git.kernel.org/stable/c/845bf3c6963a52096d0d3866e4a92db77a0c03d8
- https://git.kernel.org/stable/c/aa9ebc084505fb26dd90f4d7a249045aad152043
- https://git.kernel.org/stable/c/af8f4be3b68ac8caa41c8e5ead0eeaf5e85e42d0
- https://git.kernel.org/stable/c/d0d99f60538ddb4a62ccaac2168d8f448965f083
- https://git.kernel.org/stable/c/d3ffc8f13034af895531a02c30b1fe3a34b46432