The vulnerability arises from the Linux kernel’s handling of mount namespace copies. During attach_recursive_mnt, the code fails to examine the topmost mount in a namespace chain, causing a copy to be attached beneath the root of the mount namespace file. This results in a mount that cannot be unmounted synchronously because it retains a child, leading to an EBUSY error. The flaw does not allow arbitrary code execution but can cause denial of service by preventing clean unmounts and disrupting mount namespace state. The weakness is a failure to properly manage kernel resources, corresponding to CWE‑193.

All Linux kernel releases that have not incorporated the kernel commit 8714b44adac7b10506e1db3ef1710689751f0f10, 87ecd4c6da146363384a603bd9e90c90e7275536, or b9c40553f6ceba50042281eef6f701e5fb719726. In practice, any kernel version prior to the fix in the 2026 patch set is affected.

Quantitative metrics reveal a CVSS score of 2.3 and an EPSS score of <1%, and the issue is not listed in CISA’s KEV catalog, indicating that at present no widespread exploitation is known. The bug involves kernel internals and requires local privilege or the ability to perform bind mounts. An attacker with such access could trigger repeated EBUSY errors or mount namespace inconsistencies, potentially leading to a denial‑of‑service scenario. Because an exploit would need privileged kernel interaction, the likelihood of remote exploitation is low, but the impact of a successful local exploit can disrupt system stability.