CVE-2026-99170

A flaw was found in the Linux kernel. A local user with the ability to create user namespaces can bypass locked mount protections when transferring locks beneath existing mounts. By binding a mount namespace file beneath a locked cover and creating a new mount namespace, the covering mount is omitted during replication. This issue allows an attacker to expose and access masked or restricted files, leading to unauthorized information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.