A use‑after‑free race exists in the Linux kernel’s may_decode_fh() function, where the mount namespace pointer is accessed without holding an RCU read lock, constituting a CWE‑364 race condition. The race can happen when a handle is opened through open_tree(..., OPEN_TREE_CLONE) while the mount point is concurrently unmounted, freeing the mnt_ns after an RCU grace period. The unchecked access can lead to a kernel crash, an endless loop, or, in the worst case, leaking the result of an integer comparison in cap_capable() to user space.

All Linux kernel builds that contain the unguarded mnt_ns access in may_decode_fh() are potentially affected when one of the following configuration options is enabled: CONFIG_PREEMPTION or CONFIG_RCU_STRICT_GRACE_PERIOD. The specific kernel versions before the patch commit are not listed in the entry, so any historical kernel lacking the rcu_read_lock() on mnt_ns may be vulnerable. The vulnerability is tied to mounts created with open_tree(..., OPEN_TREE_CLONE).

The CVSS score of 7.0 places the flaw in the high severity range, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to orchestrate a precise race condition between an open_by_handle operation and an unmount that completes an RCU grace period. The likelihood of such an event occurring without deliberate intervention is low, and the impact is primarily a denial of service via kernel crash, with only subtle side channels as secondary consequences.