CVE-2026-53341

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel mnt_ns Access

Publication date: 2026-07-01

Last updated on: 2026-07-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() may_decode_fh() accesses mount::mnt_ns without holding any locks; that means the mount can concurrently be unmounted, and the mnt_namespace can concurrently be freed after an RCU grace period. This race can happens as follows, assuming that the mount point was created by open_tree(..., OPEN_TREE_CLONE): thread 1 thread 2 RCU __do_sys_open_by_handle_at do_handle_open handle_to_path may_decode_fh is_mounted [mount::mnt_ns access] [mount::mnt_ns access] __do_sys_close fput_close_sync __fput dissolve_on_fput umount_tree class_namespace_excl_destructor namespace_unlock free_mnt_ns mnt_ns_tree_remove call_rcu(mnt_ns_release_rcu) mnt_ns_release_rcu mnt_ns_release kfree [mnt_namespace::user_ns access] **UAF** Fix it by taking rcu_read_lock() around the mount::mnt_ns access, like in __prepend_path(). Additionally, document the semantics of mount::mnt_ns, and use WRITE_ONCE() for writers that can race with lockless readers. This bug is unreachable unless one of the following is set: - CONFIG_PREEMPTION - CONFIG_RCU_STRICT_GRACE_PERIOD because it requires an RCU grace period to happen during a syscall without an explicit preemption. This doesn't seem to have interesting security impact; worst-case, it could leak the result of an integer comparison to userspace (from the level check in cap_capable()), cause an endless loop, or crash the kernel by dereferencing an invalid address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-23

Generated

2026-08-11

AI Q&A

2026-07-01

EPSS Evaluated

2026-08-09

NVD

CVE-2026-53341

EUVD

EUVD-2026-40975

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.11 (inc) to 6.12.95 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free (UAF) bug in the Linux kernel related to the handling of mount namespaces in the function may_decode_fh().

The function may_decode_fh() accesses the mount namespace (mnt_ns) without holding any locks, which means the mount point can be unmounted concurrently, and the mount namespace can be freed after a Read-Copy-Update (RCU) grace period.

This race condition can lead to accessing freed memory (use-after-free), potentially causing kernel crashes or other unintended behavior.

The issue occurs only if certain kernel configurations are enabled (CONFIG_PREEMPTION or CONFIG_RCU_STRICT_GRACE_PERIOD) because it requires an RCU grace period during a syscall without explicit preemption.

The fix involves adding proper RCU read locks around the mount namespace access and using WRITE_ONCE() to prevent race conditions between writers and lockless readers.

Impact Analysis

The vulnerability does not appear to have significant security impact.

At worst, it could leak the result of an integer comparison to userspace, cause an endless loop, or crash the kernel by dereferencing an invalid address.

Such impacts could lead to system instability or denial of service but are unlikely to result in privilege escalation or data compromise.

Compliance Impact

The provided information does not indicate any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

The vulnerability is described as a use-after-free (UAF) bug in the Linux kernel related to mount namespace handling, which could potentially cause kernel crashes or leaks of minor information like the result of an integer comparison.

However, it is explicitly stated that this bug does not seem to have interesting security impact, implying no direct data breach or exposure that would typically affect regulatory compliance.

Mitigation Strategies

The vulnerability is fixed by ensuring that rcu_read_lock() is taken around the mount::mnt_ns access, similar to the approach used in __prepend_path().

Additionally, the semantics of mount::mnt_ns should be documented, and WRITE_ONCE() should be used for writers that can race with lockless readers.

Since the bug requires either CONFIG_PREEMPTION or CONFIG_RCU_STRICT_GRACE_PERIOD to be set, verifying kernel configuration and applying the patch or updated kernel version that includes this fix is recommended.

Hi! I’m here to help you understand CVE-2026-53341. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70