The vulnerability is a thread‑safety defect in the Linux kernel’s dentry cache handling. When a directory is being removed by rmdir(), unlink(), or rename(), a race condition can allow a separate bind mount operation to occur between the checks that prevent a mount at the target pathname and the actual detachment of the mount. The result is that a new mount point can be created on a dentry that is in the process of deletion, leaving a mount that references a vanished directory. Based on the description, it is inferred that an attacker can establish a mount that persists after the original pathname has been removed, potentially enabling access to files that were not intended to be exposed after deletion.

All Linux kernel versions that contain the unpatched race condition are affected. The issue arises in the core kernel; any distribution using a kernel revision before the patches referenced in the advisory (e.g., commits 30a1625, 390ddce, 5e6bfd9, 75f4197, 793cb67) includes the vulnerability. Because the kernel is common to all Linux distributions, the impact applies to all vendor implementations of Linux.

Based on the description, it is inferred that a local user with sufficient privileges to perform bind mounts (e.g., CAP_SYS_ADMIN) can trigger the race and create a mount at a deleted path. The CVSS score is 3.3, the EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. While the defect could be used to expose files or facilitate privilege escalation, the CVE description does not explicitly state these outcomes; thus, this inference is made based on the described race condition. The exploitation requires simultaneous operations on the same dentry and an ability to perform bind mounts, which are non‑trivial but within the capabilities of a privileged user.