A null pointer dereference in the Linux kernel’s fhandle handling code causes a kernel panic when a detached mount is accessed via open_by_handle_at(). The routine assumes that a mount’s namespace pointer remains valid, but a mount can be detached by operations such as open_tree(..., OPEN_TREE_CLONE) followed by umount_tree(), which clears the namespace pointer. When this pointer is NULL, the code attempts to dereference it and crashes, resulting in loss of system availability without exposing sensitive data or providing code execution.

Any Linux kernel build that does not include the recent fhandle RCU fix is vulnerable. No specific kernel version numbers are disclosed in the CVE payload, so the affected scope encompasses all kernels lacking the patch referenced in the advisory commits. The vulnerability arises in the capability checking path of filesystem handle operations.

The flaw can be triggered by an attacker who can create a detached mount and subsequently invoke open_by_handle_at() on a handle that references that mount. This requires local execution or the ability to manipulate mounts, so it is not a remote exploitation vector. The EPSS score of 0.002 and the fact that the issue is not listed in CISA KEV indicate limited reported exploitation. Nevertheless, the CVSS score of 7.8 indicates high severity because a panic guarantees immediate denial of service.