The kernel incorrectly allows the creation of automounts underneath a mount that is not in the caller's mount namespace. This condition is triggered when the parent mount namespace is marked as internal, which is always true because clone_private_mount() uses MNT_NS_INTERNAL. Consequently, attach_recursive_mnt() treats this as a valid mount point and count_mounts() dereferences the internal pointer, resulting in a null pointer dereference and a general protection fault. The failure propagates to user space when a fanotify event is processed, causing a kernel panic and system hang.

The flaw exists in the Linux kernel and affects any kernel build that contains the buggy automount handling logic. No specific kernel version range is listed, so all installations of a Linux kernel that have not been patched with the is_mounted() check are potentially vulnerable. The vulnerability can be triggered by user-space processes that create fanotify marks on an overlay filesystem whose lower layer is an unmounted or debugfs mount.

Because the vulnerability leads to an unconditional crash, the impact is a denial of service. The CVSS score of 4.7 indicates moderate severity. The EPSS score is < 1%, implying that active exploitation is unlikely, but the presence of a local exploit path via fanotify makes the vulnerability exploitable by any local process capable of creating fanotify events on an overlay with an unmounted lower layer. The kernel panic prevents the system from handling further operations and blocks all processes until a reboot or recovery, resulting in a system-wide denial of service.