In Linux, a flaw in the clone_mnt() function allows the internal MNT_UMOUNT flag to be copied to new mounts. A mount that has been lazily unmounted but remains alive through a file descriptor can be duplicated with the flag still set. This leads to a cascade of bugs where the mount namespace can leak references, causing use‑after‑free and potential privilege escalation. The vulnerability is rooted in improper handling of internal flag copying and the failure to clear or propagate MNT_UMOUNT during namespace operations.

The flaw is in the Linux kernel, affecting all distributions that ship this code. No specific version range is listed in the CNA data, so the issue may exist in any kernel containing the unpatched clone_mnt() implementation.

The CVSS score is not supplied, but the kernel nature of the bug and its ability to trigger memory corruption mark it as high severity. EPSS is not available and the flaw is not yet listed in CISA KEV, yet the exploit path requires no special pre‑conditions beyond the ability to perform bind mounts. A malicious or compromised privileged process could exploit the flaw by creating a mount namespace that inherits this flag, leading to a use‑after‑free when the namespace is destroyed. The likely attack vector is a privileged or root process manipulating namespace mounts.