CVE-2026-98980

A flaw was found in the Linux kernel. A race condition during reference-based path lookup allows a local user to access files hidden beneath mount points, resulting in information disclosure. When an overmounted file or directory is unlinked or removed while another process traverses the path, the kernel fails to properly validate the mount state before returning the underlying directory entry. A local attacker can exploit this timing window to read sensitive data that should be obscured by mounted filesystems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.