This vulnerability resides in the binfmt_misc subsystem of the Linux kernel. A warning is emitted in bm_fill_super when a user creates a binfmt_misc context in one user namespace and later completes the mount in a different namespace without proper validation. The warning is not once‑only, so a malicious user can trigger it repeatedly, causing kernel taint, excessive log traffic, and on systems configured with panic_on_warn the kernel may panic, effectively denying service.

The flaw affects all Linux kernel builds that include the binfmt_misc code path described in the CVE. No specific kernel version is listed, so any kernel lacking the upstream fix is potentially vulnerable.

The CVSS score is 5.5 and the EPSS score is below 1%, indicating a moderate severity and a low probability of widespread exploitation. The issue is not in the CISA KEV catalog. Attackers need only ordinary user privileges and the ability to invoke unshare(1) to create a user and mount namespace, then use fsopen and fsconfig to provoke the warning. The local nature of the vulnerability limits impact to the compromised host, but repeated exploitation can exhaust logging resources, trigger kernel taint, and on certain configurations cause a kernel panic, leading to a denial of service.