Technical impact
The Linux kernel's namespace subsystem allows recursive bind mounts of namespace files without adequate loop detection. When a mount namespace file is bind‑mounted with the MS_REC flag, the kernel copies all nested namespace files, potentially creating a cycle that is not detected because the check only examines the dentry of the bind mount start. Repeating this action causes the kernel to allocate shared memory for each new namespace instance, increasing resource usage until the system runs out of shared memory, leading to a denial‑of‑service. The CWE identifier CWE‑772 indicates a circular resource usage issue.
Affected Systems
All Linux kernel implementations that have not incorporated the patch fixing the do_loopback() loop check are affected. No specific version ranges are provided in the data, so kernel administrators should consider any unpatched kernel version vulnerable.
Risk and Exploitability
Based on the description, it is inferred that the attack vector requires local execution privileges, typically root or processes with CAP_SYS_ADMIN, to issue bind mounts. The vulnerability is not listed in the CISA KEV catalog and has an EPSS score of <1%, indicating a low probability of exploitation. The CVSS score of 5.5 reflects moderate severity. If an attacker can perform recursive bind mounts on nsfs or pidfs files, the kernel will allocate shared memory for each new namespace, and an attacker can trigger resource exhaustion. Even though the exploit likelihood is low, the potential for system instability and denial of service remains a concern in privileged environments.
Ubuntu USN