GHSA-vgv8-2mh4-qh7r · Severity: medium — In the Linux kernel, the following vulnerability has been resolved: unshare: fix unshare_fs()...
In the Linux kernel, the following vulnerability has been resolved: unshare: fix unshare_fs() handling There's an unpleasant corner case in unshare(2), when we have a CLONE_NEWNS in flags and current->fs hadn't been shared at all; in that case copy_mnt_ns() gets passed current->fs instead of a private copy, which causes interesting warts in proof of correctness] > I guess if private means fs->users == 1, the condition could still be true. Unfortunately, it's worse than just a convoluted proof of correctness. Consider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS (and current->fs->users == 1). We pass current->fs to copy_mnt_ns(), all right. Suppose it succeeds and flips current->fs->{pwd,root} to corresponding locations in the new namespace. Now we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM). We call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's destroyed and its mount tree is dissolved, but... current->fs->root and current->fs->pwd are both left pointing to now detached mounts. They are pinning those, so it's not a UAF, but it leaves the calling process with unshare(2) failing with -ENOMEM _and_ leaving it with pwd and root on detached isolated mounts. The last part is clearly a bug. There is other fun related to that mess (races with pivot_root(), including the one between pivot_root() and fork(), of all things), but this one is easy to isolate and fix - treat CLONE_NEWNS as "allocate a new fs_struct even if it hadn't been shared in the first place". Sure, we could go for something like "if both CLONE_NEWNS *and* one of the things that might end up failing after copy_mnt_ns() call in create_new_namespaces() are set, force allocation of new fs_struct", but let's keep it simple - the cost of copy_fs_struct() is trivial. Another benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets a freshly allocated fs_struct, yet to be attached to anything. That seriously simplifies the analysis... FWIW, that bug had been there since the introduction of unshare(2) ;-/
Conclusion & alert: CVE-2026-43472 is rated Low Risk (24.5/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.02%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-09 | — | 0.02% | — |
Full EPSS history (1 record total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.5 | 3.1 | MEDIUM |
|
1.8 | 3.6 | [email protected] |
GHSA-vgv8-2mh4-qh7r · Severity: medium — In the Linux kernel, the following vulnerability has been resolved: unshare: fix unshare_fs()...
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2026-43472 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2026-43472 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2026-43472 |
suse
|
medium | CVE-2026-43472 severity moderate: SUSE including 16 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 41 product×package rows across 11 product lines (SUSE Linux Enterprise High Availability Extension 15 SP7, SUSE Linux Enterprise Live Patching 15 SP7, … (11 product lines)): Known Not Affected 41. | https://www.suse.com/security/cve/CVE-2026-43472/ |
ubuntu
|
medium | CVE-2026-43472 medium priority: Ubuntu including 161 source packages (linux, linux-allwinner-5.19, …), 1449 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1048, ignored 173, needed 130, released 87, not-affected 10, needs-triage 1. | https://ubuntu.com/security/CVE-2026-43472 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| linux | linux_kernel | >= 2.6.16.1, < 5.10.253 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 5.11, < 5.15.203 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 5.16, < 6.1.167 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.2, < 6.6.130 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.7, < 6.12.78 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.13, < 6.18.19 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.19, < 6.19.9 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:-:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:rc3:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:rc4:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:rc5:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:rc6:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:rc7:*:*:*:*:*:* |
| linux | linux_kernel | 7.0 | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |