GHSA-vgv8-2mh4-qh7r · 深刻度： medium — In the Linux kernel, the following vulnerability has been resolved: unshare: fix unshare_fs()...
In the Linux kernel, the following vulnerability has been resolved: unshare: fix unshare_fs() handling There's an unpleasant corner case in unshare(2), when we have a CLONE_NEWNS in flags and current->fs hadn't been shared at all; in that case copy_mnt_ns() gets passed current->fs instead of a private copy, which causes interesting warts in proof of correctness] > I guess if private means fs->users == 1, the condition could still be true. Unfortunately, it's worse than just a convoluted proof of correctness. Consider the case when we have CLONE_NEWCGROUP in addition to CLONE_NEWNS (and current->fs->users == 1). We pass current->fs to copy_mnt_ns(), all right. Suppose it succeeds and flips current->fs->{pwd,root} to corresponding locations in the new namespace. Now we proceed to copy_cgroup_ns(), which fails (e.g. with -ENOMEM). We call put_mnt_ns() on the namespace created by copy_mnt_ns(), it's destroyed and its mount tree is dissolved, but... current->fs->root and current->fs->pwd are both left pointing to now detached mounts. They are pinning those, so it's not a UAF, but it leaves the calling process with unshare(2) failing with -ENOMEM _and_ leaving it with pwd and root on detached isolated mounts. The last part is clearly a bug. There is other fun related to that mess (races with pivot_root(), including the one between pivot_root() and fork(), of all things), but this one is easy to isolate and fix - treat CLONE_NEWNS as "allocate a new fs_struct even if it hadn't been shared in the first place". Sure, we could go for something like "if both CLONE_NEWNS *and* one of the things that might end up failing after copy_mnt_ns() call in create_new_namespaces() are set, force allocation of new fs_struct", but let's keep it simple - the cost of copy_fs_struct() is trivial. Another benefit is that copy_mnt_ns() with CLONE_NEWNS *always* gets a freshly allocated fs_struct, yet to be attached to anything. That seriously simplifies the analysis... FWIW, that bug had been there since the introduction of unshare(2) ;-/
総合評価: CVE-2026-43472 は低リスク（22.7/100）。CVSS 深刻度は中。悪用される可能性が高い（EPSS 0.11%、2 パーセンタイル） 推奨対応: 悪用情報と EPSS の推移を監視し、必要に応じて優先度を見直してください。
リスクは変動します。再評価に基づき、本ページの表示内容を更新しています。
EPSS は日次で悪用されやすさの相対度合いを推定します。パーセンタイルは採点済み CVE の中での相対位置（高いほど相対的に深刻）を示します。
| # | 日付 | 旧 EPSS スコア | 新 EPSS スコア | Δ（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.02% | 0.11% | +0.09% |
| 2 | 2026-05-09 | — | 0.02% | — |
EPSS の全履歴 （全 2 件）
この CVE の CVSS 指標。
| ベーススコア | バージョン | 深刻度 | ベクトル | 悪用しやすさ | 影響 | スコアの出典 |
|---|---|---|---|---|---|---|
| 5.5 | 3.1 | MEDIUM |
|
1.8 | 3.6 | [email protected] |
GHSA-vgv8-2mh4-qh7r · 深刻度： medium — In the Linux kernel, the following vulnerability has been resolved: unshare: fix unshare_fs()...
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2026-43472 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2026-43472 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2026-43472 |
suse
|
medium | CVE-2026-43472 severity moderate: SUSE including 16 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 41 product×package rows across 11 product lines (SUSE Linux Enterprise High Availability Extension 15 SP7, SUSE Linux Enterprise Live Patching 15 SP7, … (11 product lines)): Known Not Affected 41. | https://www.suse.com/security/cve/CVE-2026-43472/ |
ubuntu
|
medium | CVE-2026-43472 medium priority: Ubuntu including 161 source packages (linux, linux-allwinner-5.19, …), 1449 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1048, ignored 173, needed 130, released 87, not-affected 10, needs-triage 1. | https://ubuntu.com/security/CVE-2026-43472 |
| ベンダー | 製品 | バージョン | 生の CPE |
|---|---|---|---|
| linux | linux_kernel | >= 2.6.16.1, < 5.10.253 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 5.11, < 5.15.203 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 5.16, < 6.1.167 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.2, < 6.6.130 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.7, < 6.12.78 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.13, < 6.18.19 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | >= 6.19, < 6.19.9 | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:-:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:rc3:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:rc4:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:rc5:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:rc6:*:*:*:*:*:* |
| linux | linux_kernel | 2.6.16 | cpe:2.3:o:linux:linux_kernel:2.6.16:rc7:*:*:*:*:*:* |
| linux | linux_kernel | 7.0 | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |