In the Linux kernel, the process that queues mount notifications does not check if a mount is already queued. This oversight allows the same mount to be added to the notification list twice, resulting in a use‑after‑free condition. The Kubernetes Stack‑Address‑Sanitizer logs show a read of freed memory when the notify list is processed, exposing kernel memory for corruption. An attacker who can trigger the double‑queue path—by performing a sequence of mount and unmount operations on the same namespace—could potentially execute arbitrary code within the kernel or cause a denial of service by corrupting internal mount structures.

All Linux kernel releases that contain the unpatched double‑queue logic for mount notifications are vulnerable. The issue persists until the kernel is updated with the resolution for this bug. No specific vendor versions are listed, so the vulnerability applies to any Linux kernel that has not yet received the official patch.

The lack of a CVSS score and EPSS data does not diminish the severity; the bug leads directly to kernel memory corruption, which is a high‑risk vulnerability. Since the flaw is triggered by local mount operations, the attack vector is local and would require the ability to perform privileged mounts. The vulnerability is not listed in CISA KEV, but its exploitability remains high if a local attacker can orchestrate the required mount sequence.