Linux kernel: Use-after-free in mount notification handling
Summary
A flaw in the mount-namespace notification code of the Linux kernel can cause a mount to be queued twice for notifications. This leads to a use-after-free on freed memory, which can be used by a local user to crash the system or possibly escalate privileges. The trigger needs a user-namespace-capable local account and a mount namespace watch (FAN_MARK_MNTNS) combined with a mount that has MNT_SHRINKABLE set, such as NFS, AFS, CIFS or tracefs automounts.
Affected
- Linux kernel from 6.15 (per the CNA record; the version range is not independently verified)
- Earlier versions: unaffected per the CNA record
- Distribution kernels: vary; Ubuntu lists all supported releases as Needs evaluation
- Bell-SW Alpaquita linux-lts: affected from 6.18.55-r0 (vendor-specific, not upstream)
Fixed in
- Upstream stable fixes per the CNA record and OSV: 6.18.57 and 7.2.11
- Fix commits: 702ff3fe499876e09c45558a05366d21a5bc41ab, acbe9e4418e2ef7bef1a12e62e0e7d6145a15190, bd2feb7796b6585938a4241e7b7c4148a6f7b762
- Alpaquita: fixed in 6.18.58-r0
- Distribution fixed packages: Unknown.
Workaround
- No vendor-issued workaround known.
- Where patching is not yet possible, restrict unprivileged user namespaces if the distribution allows it, and limit local shell access on multi-user hosts.
Exploitation
- No evidence of exploitation in the wild found.
- No CISA KEV entry found.
- No public proof of concept found in the searches performed; this is not exhaustive.
- EPSS score 0.00157 (very low).
Our recommendation
- Identify Linux hosts with multiple local users, container or CI workloads, or NFS, CIFS, AFS automounts or fanotify mount-namespace watches.
- Apply the distribution kernel update as soon as it is published; check the distribution advisory for the exact fixed package.
- Until then, restrict unprivileged user namespaces and local access where possible.
- Monitor hosts for unexpected privilege escalation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable fix commit 702ff3fe git.kernel.org
- Linux kernel stable fix commit acbe9e44 git.kernel.org
- Linux kernel stable fix commit bd2feb77 git.kernel.org
- Ubuntu security tracker ubuntu.com
- OSV: Bell-SW Alpaquita tracker osv.dev
- Vulners NVD record vulners.com
- Red Hat security data access.redhat.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:33.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mnt_notify_add() puts a mount on notify_list. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per namespace_sem hold. It isn't. propagate_umount() moves a surviving overmount off a stack of mounts that are going away and queues it as moved. shrink_submounts() and mark_mounts_for_expiry() call umount_tree() for several mounts under a single namespace_sem hold. So the second umount_tree() can take down exactly the mount the first one reparented, reparent it once more and so end up queueing it a second time. The second list_add_tail() cuts the mounts queued in between out of the list while the head still points at the last of them. notify_mnt_list() then only visits that one mount and the others are freed after the grace period with notify_list still pointing at them. Every later mount operation on the host walks freed memory: BUG: KASAN: slab-use-after-free in __list_add_valid_or_report Read of size 8 at addr ffff8881003d57e0 by task notify_dq/162 __list_add_valid_or_report+0x15c/0x1a0 mnt_add_to_ns+0x322/0x890 attach_recursive_mnt.isra.0+0xf2a/0x1a00 path_mount+0x139c/0x1d40 This needs a mount with MNT_SHRINKABLE to bind from. That's what finish_automount() creates (submounts of NFS, AFS and CIFS and the tracefs mount below debugfs). Bind mounts inherit the flag. A mount namespace with a FAN_MARK_MNTNS mark does the rest and root in a user namespace can have both. Initialize to_notify in alloc_vfsmnt() and leave a mount alone that is queued already. mnt_notify() looks at the state the mount has when the list is drained so a single entry per mount is enough. The move event for a mount that is unmounted under the same hold is lost. That's fine. The detach is what matters.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.