In the Linux kernel, the process that queues mount notifications does not check if a mount is already queued. This oversight allows the same mount to be added to the notification list twice, resulting in a use‑after‑free condition. The KASAN logs show a read of freed memory when the notify list is processed, exposing kernel memory for corruption. An attacker who can trigger the double‑queue path—by performing a sequence of mount and unmount operations on the same namespace—could potentially execute arbitrary code within the kernel or cause a denial of service by corrupting internal mount structures.

All Linux kernel releases that contain the unpatched double‑queue logic for mount notifications are vulnerable. The issue persists until the kernel is updated with the resolution for this bug. No specific vendor versions are listed, so the vulnerability applies to any Linux kernel that has not yet received the official patch.

The CVSS score of 7.8 classifies this vulnerability as medium‑high, indicating significant risk. The EPSS score of < 1% suggests that widespread exploitation is unlikely at present, and the vulnerability is not listed in CISA KEV. However, the flaw leads directly to kernel memory corruption, which poses a high‑risk exploitation potential. The vulnerability is triggered by local mount operations and requires privileged mount permissions, making the attack vector local. If a local attacker can orchestrate the required mount sequence, exploitability remains high.