An unprivileged user can create an overlay filesystem mount that triggers a WARN_ON in the Linux kernel’s overlayfs code. The flaw results from missing privilege checks on the user namespace used during fsconfig, bypassing capability enforcement. The warning can be raised repeatedly, allowing the attacker to flood system logs, and the kernel will panic if it is booted with panic_on_warn enabled. This represents a misuse of capabilities (CWE‑617).

All Linux kernel releases that provide overlayfs are affected; the vulnerability applies to any system running a standard Linux kernel where overlayfs is enabled. No specific version range is provided, so distributions must verify whether they have applied the upstream fix.

The CVSS score of 5.5 indicates medium severity, and the EPSS score is less than 1%, with the vulnerability not listed in the CISA KEV catalog. The vulnerability is local; an attacker can use unshare(1) to create a child process, call fsopen("overlay") to obtain a file descriptor, pass that descriptor to a parent process, and finish the mount with fsconfig. The code comments indicate that the WARN_ON can be raised in a loop, which is inferred to allow repeated log entries or a flood of kernel warnings. If panic_on_warn is enabled, the warning can cause a kernel panic, which is a more severe impact. The potential for log flooding is therefore a concern, but this conclusion is inferred from the description rather than explicitly stated in the CVE data.