The Linux kernel function open_tree(OPEN_TREE_NAMESPACE) incorrectly copies mount trees that contain covering mounts. An attacker who can create an unprivileged user namespace can clone a source namespace that includes hidden mounts, then switch to the new namespace and access files that should remain protected by covering mounts. This flaw allows local users with only standard privileges to read data hidden from other processes, constituting a breach of confidentiality.

All Linux kernels that implement open_tree and setns without the patch are affected. The issue is inherent to the kernel’s namespace handling and is not limited to a specific distribution or vendor. Any system running an unpatched kernel may be vulnerable, regardless of whether it uses container runtimes or standard user space tools.

The CVSS score of 8.8 marks this as a high‑severity information‑disclosure vulnerability. The EPSS score of less than 1 % suggests that exploitation is relatively uncommon, but the flaw remains locally exploitable. The attack vector is inferred to be local only, requiring the ability to create a user namespace and invoke open_tree and setns; no network interaction is needed. The vulnerability is not listed in the CISA KEV catalog. A successful exploit would allow an attacker to read files that other processes are prevented from accessing by covering mounts.