Expired Pointer Dereference Affecting kernel-livepatch-6.12.113-138.209 package, versions <1:1.0-0.amzn2023
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-AMZN2023-KERNELLIVEPATCH612113138209-21809676
- published29 Oct 2026
- disclosed23 Oct 2026
Introduced: 23 Oct 2026
NewCVE-2026-98982 (opens in a new tab)How to fix?
Upgrade Amazon-Linux:2023 kernel-livepatch-6.12.113-138.209 to version 1:1.0-0.amzn2023 or higher.
This issue was patched in ALAS2023-2026-3335.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-livepatch-6.12.113-138.209 package and not the kernel-livepatch-6.12.113-138.209 package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
namespace: don't let a pseudo dentry become the root of a mount
d_alloc_pseudo() hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHE_NORCU and dentry_free() frees them right away because no lockless path walk can ever reach them. That holds as long as such a dentry isn't the root of a mount. But bind mounting /proc/self/fd/<fd> of such a file does exactly that.
Most callers of alloc_file_pseudo() put their files on kernel-internal mounts and may_copy_tree() refuses those. bpf_token_create() doesn't. It places the token file on the bpffs mount the caller handed it and that mount is in the caller's mount namespace so the clone goes through:
mount --bind /proc/self/fd/<token> <file> open_tree(tokfd, "", AT_EMPTY_PATH | OPEN_TREE_CLONE) + move_mount()
__follow_mount_rcu() then loads ->mnt_root of that mount, reads d_seq and d_flags of the dentry and only then checks mount_lock. The dentry can be gone by then. The final mntput() of an unmounted parent unhooks a child that stayed attached to it under mount_lock alone. When the child's holder does the final put right after that the root is dput() and freed immediately while a walker that found the mount hashed still looks at it.
Refuse to clone a mount with a DCACHE_NORCU dentry as its root. Nothing sensible can be done with a bind mount of a bpf token anyway.
References
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98982
- https://git.kernel.org/stable/c/00287afa7cd989efdbf5822b7efac33cce7d489a
- https://git.kernel.org/stable/c/7e1c466011ba9e64d43075396badc03191bcee44
- https://git.kernel.org/stable/c/a256e31e0c54c4c37d2523aa52faabdcdd2ebc07
- https://git.kernel.org/stable/c/b138e16fb1e81376cea89f727dda7bfccd140de4