The vulnerability in the Linux kernel’s nsproxy handling causes active namespace reference counts to become negative when an unshare operation fails due to a set_cred_ucounts error. This negative count undermines the integrity of namespace reference tracking, leading to references being incorrectly dropped and namespaces that a caller uses no longer appearing in listns. The flaw could produce instability by leaving namespaces in an inconsistent state, but the description does not specify a direct crash or memory corruption.

The vulnerability affects Linux kernel installations that lack commit cefd55bd2159. No specific kernel versions are listed, so all current kernels missing this commit may be vulnerable. System administrators should verify that the running kernel contains the fix introduced by the commit.

The likely attack vector is local; based on the description, a local user capable of invoking the unshare system call could trigger the vulnerability. The EPSS score of less than 1% indicates a very low probability of exploitation, and it is not listed in the CISA KEV catalog, implying no known widespread current use. The CVSS score of 4.7 denotes medium severity; while the exact impact may not be a crash, the inconsistent namespace state could disrupt affected processes. The lack of publicly available exploits suggests that immediate exploitation is unlikely, but the potential impact warrants timely patching.