The flaw in the Linux kernel occurs during mount reparenting: a reference to an overmount child is not cleared, leaving a dangling pointer when the original mount is unmounted and freed. The dangling pointer can later be accessed during normal mount operations, resulting in a use‑after‑free condition that corrupts memory. If an attacker can manipulate mounts or file descriptors in close proximity to the freed mount, they could potentially trigger code execution with kernel privileges.

All installations of the Linux kernel that include the legacy mount handling code paths involved in mnt_change_mountpoint, reparent, and propagate_umount. No specific kernel release is listed, so the vulnerability may affect any kernel version that has not applied the patch. This issue affects the Linux kernel.

The CVSS score of 7.8 indicates a high severity. Because this exploit requires manipulation of mount points and file descriptors, it is likely confined to trusted users or privileged processes—root or processes with CAP_SYS_ADMIN—which limits the attack surface but does not eliminate risk. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, so current exploitation evidence is not known. Nonetheless, the combination of a UAF and kernel code execution warrants close attention and timely patching.