In the Linux kernel, the path_pivot_root routine incorrectly reads the parent mounts of a new_root or the caller’s root before validating that those mounts belong to the caller’s mount namespace. This ordering creates a use‑after‑free scenario when a mount is unmounted but a file descriptor still references it. The stale read causes a kernel panic or memory corruption. The weakness is captured by CWE-825: Use After Free and manifests as an unintended kernel crash or potential privilege escalation.

The flaw exists in all versions of the Linux kernel preceding the inclusion of commit bb4609405752. Both the pivot_root and chroot system calls are affected. Commonly impacted scenarios include container initialization, initramfs setups, and scripts that modify the root filesystem. Specific version numbers are not supplied; however, any kernel built before the fix is potentially vulnerable.

The CVSS score of 5.5 points to a moderate severity, while the EPSS score of <1% indicates a very low likelihood of widespread exploitation. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attack requires local privileged code that can invoke pivot_root or chroot and manipulate mounts via file descriptors. The attacker would create a mount that becomes unmounted while still referenced, then call pivot_root or chroot, causing the kernel to read freed memory. Although the function returns EINVAL, the underlying memory corruption could lead to a crash or, in worst cases, arbitrary code execution.