This vulnerability involves the Linux kernel’s binfmt_misc subsystem. The flaw arises from a WARN_ON in bm_fill_super that is not tied to the same user namespace that created the binfmt_misc context. An attacker can create a context inside a user namespace, pass the context file descriptor to another process in a different namespace, and then trigger fsconfig to generate the warning. Because the warning is not once‑only, a malicious process can produce it repeatedly, tainting the kernel, flooding system logs, and on systems that have panic_on_warn enabled causing the kernel to panic. The vulnerability does not allow code execution, but it can disrupt system availability and integrity.

The affected product is the Linux kernel’s binfmt_misc subsystem. No specific kernel version information is provided in the CVE data, so the flaw applies to any kernel build that implements the stated code paths.

The CVSS score is not available, and EPSS is not reported. The flaw is local; an attacker needs only ordinary user privileges and the ability to execute unshare(1) and socket operations. Because the warning can be triggered in a loop, a determined attacker can cause sustained log flooding, kernel taint, and a possible panic on systems configured with panic_on_warn, leading to a denial of service. Since the issue is not in CISA KEV and lacks an official fix, the exploitation likelihood is moderate to high for environments that enable the vulnerable feature.