The vulnerability arises in the handling of the pivot_root system call within the Linux kernel. A use‑after‑free occurs when the kernel reads the parent mounts of a new_root or the caller’s root before verifying that those mounts belong to the caller’s mount namespace. If a mount is unmounted but still referenced by a file descriptor, the parent may be freed and the subsequent read of freed memory triggers a KASAN error. The erroneous memory read fulfills the error path and returns EINVAL, but the underlying memory corruption can lead to a kernel crash or arbitrary kernel memory corruption that an attacker might exploit to gain elevated privileges.

The flaw is present in all releases of the Linux kernel that predates the fix in commit bb4609405752. No specific version range is currently listed, so any running kernel that has not incorporated that commit is potentially affected. Systems that rely on the pivot_root or chroot mechanisms while manipulating mounts are the most directly exposed; typical affected environments include containers, initramfs setups, and systems performing rootfs upgrades.

The CNAs do not list the vulnerability in the CISA KEV catalog, and the Exploit Prediction Scoring System does not provide a current score, leaving the exact exploitation likelihood uncertain. However, the presence of a use‑after‑free in a privileged kernel function and the lack of an immediate error return suggest that an attacker with local root or sufficient kernel access could potentially trigger memory corruption to crash the kernel or execute arbitrary code. The likely attack vector involves constructing a mount that is unmounted while still referenced by a file descriptor and then invoking pivot_root or chroot with that descriptor. Although the default behavior returns EINVAL, the memory corruption path remains present and could be leveraged by a sophisticated attacker.