During the copy‑tree operation in the Linux kernel, a bug allows recursive copying of mounts that have been lazily unmounted but remain alive through an open file descriptor. The may_copy_tree function does not confirm that a mount is still active before copying it, so a bind mount of a namespace or PID namespace that has been removed can propagate its entire descendant stack to the new mount destination. Based on the description, this flaw is a form of access‑control failure that can duplicate mounts, leave dangling namespace references, or cause the operation to return EINVAL. The consequence is inconsistent namespace state and the potential for resource exhaustion if a large stack of mounts is duplicated.

All Linux kernel configurations that support nsfs or pidfs mount namespaces are affected. The specific kernel release that ships the fix is not disclosed in the available data, so any kernel that allows lazy unmounts of namespace mounts with an open file descriptor remains vulnerable until a patch is applied.

The CVSS score of 4.4 indicates moderate risk, while the EPSS score of less than 1% suggests a low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local execution with privileges sufficient to create or manipulate mount namespaces (root or CAP_SYS_ADMIN). Based on the description, it is inferred that an attacker could trigger resource exhaustion or an inconsistent namespace state by repeatedly performing the sequence of lazy unmount followed by bind mounting a file descriptor of the original mount and then recursively copying the mount tree.