In the Linux kernel, a bug in the copy_tree handling of mount namespaces allows the recursive copying of mounts that are lazily unmounted but still kept alive by an open file descriptor. This is a CWE-20 weakness, where the code fails to properly validate input (mount state) before copying. The may_copy_tree function does not verify that a mount is still active before copying, causing the entire unmounted stack to be duplicated when AT_RANK or MS_REC options are used. This flaw could result in duplicated mounts, stale namespace references, or an EINVAL error if the operation fails. The practical effect is that an attacker with the ability to manipulate mounts might disrupt kernel operations or unintentionally expose duplicate namespace mounts within the system.

The failure occurs within the Linux kernel and affects all kernel configurations that support NSFS or PIDFS mount namespaces. No specific kernel versions or sub-release information is disclosed in the advisory, so any kernel utilizing these namespaces could be impacted until patched.

The CVSS score and EPSS values are not provided and the vulnerability is not listed in the CISA KEV catalog, indicating a lower publicly known exploitation potential. Exploitation would require local access with permission to create and manipulate mount namespaces, typically requiring root or the CAP_SYS_ADMIN capability. While the exploitability is constrained to systems where lazy unmounts of namespace mounts are performed, the impact of unintentional propagation could lead to resource exhaustion or inconsistent namespace state, warranting careful evaluation.