The vulnerability occurs when a binfmt_misc mount fails; the kernel function bm_get_tree() holds a reference to the user namespace that is never released if bm_fill_super() fails. As a result, each failed mount attempt leaks one user‑namespace object. An unprivileged user within a constrained memory cgroup can repeatedly trigger the failure, exhausting the cgroup’s memory and preventing further mounts. The leak does not expose confidential data, but it enables a denial‑of‑service attack by draining available user‑namespace resources.

The flaw resides in the Linux kernel; all kernel releases that contain the unpatched binfmt_misc mount code are affected. No specific version range is supplied in the input, so the vulnerability should be considered present in all kernels that have not yet incorporated the described fix.

The risk is limited to local attackers with unprivileged access who can invoke binfmt_misc mounts. Because exploitation relies on repeated failure of simple_fill_super(), the attack requires control over the mount command and a tight memory cgroup to observe the leakage effect. The CVSS score is 5.5, and the EPSS score is < 1%, so the overall exploitation probability is presumed moderate. The vulnerability is not listed in the CISA KEV catalog.