This vulnerability allows a locked mount to remain active even after its ancestor mount is unmounted, causing the information that was protected by the locked mount to become visible. The bug in the kernel prevents the locked state from expiring during shrink_submounts, so an attacker can expose hidden directories after venturing a mount beneath a locked mount and then unmounting the parent. The result is that files and directories that should be shielded from the mount namespace become accessible, leading to an information disclosure scenario.

The flaw is present in the Linux kernel. No specific version numbers are provided, so the issue may affect any installed kernel that has not been patched for the reported bug.

The CVSS score is 8.4 and EPSS is < 1%, but the exploit requires the ability to perform MOVE_MOUNT_BENEATH, which in turn requires CAP_SYS_ADMIN (inferred from kernel capabilities). Therefore the practical attack vector is privileged or containerized systems where a process with administrative capabilities can manipulate mount namespaces. While the situation does not allow arbitrary code execution or privilege escalation in the generic sense, it does allow an attacker to read otherwise protected filesystem content. Because the vulnerability is surface‑level and requires privileged capabilities, the likelihood of exploitation in normal deployment is moderate, but any system using untrusted code or running containers with broad mount authority should be considered at risk.