The vulnerability involves incorrect locking of mounts propagated across user namespaces in the Linux kernel. The kernel mistakenly locks the host’s mount instead of the copy in the child namespace, allowing processes in the child namespace to attempt a bind remount on the host’s mount. The bind remount succeeds where it should be denied (EPERM), effectively permitting unhindered modification of mount flags. Based on the description, it is inferred that such flag changes could be leveraged to gain elevated privileges or expose restricted files, but the vulnerability’s description does not assert these outcomes directly.

The flaw affects any Linux kernel version prior to the patch that corrects mount locking for automount propagation, regardless of architecture or distribution. No specific version numbers are provided, so all kernels where the affected code path is exercised remain vulnerable. Those systems that use automounts that propagate across user or mount namespaces are at risk.

The CVSS score is 4.4, the EPSS score is less than 1%, and the vulnerability is not listed in CISA KEV. The attack vector appears to be local, requiring the ability to create or enter a user or mount namespace and trigger automount propagation. While no public exploit has been disclosed, the bug permits an attacker to modify mount flags in a parent namespace that should otherwise be protected. The risk is considered moderate until a kernel update containing the fix is deployed, and the potential impact is noteworthy if the attacker can leverage the flag changes to increase privileges or access protected resources.