In the Linux kernel, removing fsnotify marks from a mount namespace while the kernel is in an RCU softirq context causes the code to acquire a mutex that is only safe in process context. This mismatch triggers a BUG and can lead to a kernel panic, effectively denying service. An attacker with root privileges inside a user namespace can create a fanotify group that sets a FAN_MARK_MNTNS mark on another task’s mount namespace. When that task exits, the residual mark is deleted during an RCU softirq, satisfying the crash condition. The flaw does not grant elevated privileges beyond what is already available to the attacker. The issue corresponds to CWE‑821, a deadlock or context misuse weakness, whereby synchronization primitives are used in an inappropriate execution context. A kernel panic caused by this bug results in an immediate loss of operating system services; data in memory may be lost or corrupted.

All Linux kernel releases are potentially impacted because the vulnerability resides in core kernel code and the supplied CPE string covers the entire Linux kernel family. No specific version constraints are provided, so every kernel distribution could be affected until the fix is applied.

The CVSS score of 5.5 denotes moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires root privileges within a user namespace, limiting the attack surface to privileged users. An attacker who can execute as root in a user namespace can trigger the kernel panic and cause a denial‑of‑service event.