The flaw lies in the Linux kernel’s handling of the unshare(2) system call. When a process requests a new mount namespace through CLONE_NEWNS while its current filesystem structure (fs_struct) has not yet been isolated, the kernel duplicates this structure but later damages the calling process’s filesystem pointers if a subsequent namespace creation such as copy_cgroup_ns() fails. As the root and current working directory of the process are left pointing to mounts that have been torn down, the process can encounter crashes, undefined behavior, or other filesystem inconsistencies. This effectively creates a local denial‑of‑service condition where a helper process cannot recover except by restarting or remounting the affected mounts.

All releases of the Linux kernel that predate the commit identified by the hash 42e21e74061b0ebbd859839f81acf10efad02a27 are affected. Systems running a kernel that contains this commit or newer versions are no longer vulnerable. The issue applies universally to the Linux kernel across distributions, as the vulnerability is tied to the core kernel source.

The CVSS score of 7.0 indicates moderate severity. The EPSS score is below 1%, suggesting a low exploitation probability. It is not listed in the CISA KEV catalogue, further indicating that exploitation risk is currently low. The likely attack vector requires a process to invoke unshare(2) with CLONE_NEWNS (and optionally other namespace flags such as CLONE_NEWCGROUP) and have the subsequent namespace creation fail. Because creating a new cgroup namespace typically demands elevated privileges, the vulnerability is most likely exploitable by a local user with sufficient kernel capabilities. The end result is a service interruption for the affected process rather than privilege escalation or remote compromise.