CVE-2026-72034

Received Received - Intake

Linux Kernel Mount Namespace Use-After-Free Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capable_wrt_mount() The recent fhandle RCU fix moved the mount namespace capability check into capable_wrt_mount(), so a non-NULL mnt_namespace survives the ns_capable() dereference. The helper still assumes the later READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh() checked is_mounted() first. That assumption is not stable. A detached mount from open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while open_by_handle_at() is between those checks, and umount_tree() can clear mount->mnt_ns. If the helper observes NULL, it dereferences mnt_ns->user_ns and panics. Return false when the RCU read observes a detached mount. This keeps the relaxed permission path conservative: a mount no longer attached to a namespace cannot authorize open_by_handle_at() access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72034

EUVD

EUVD-2026-58992

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the fhandle subsystem. When a detached mount is dissolved during a file operation, the kernel may dereference a null pointer in the mount namespace, leading to a system panic. The fix ensures that detached mounts are rejected during permission checks to prevent this issue.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level inspection. Detection involves checking for kernel panic logs or system crashes related to mount namespace handling. No direct network detection commands are applicable.

Impact Analysis

If exploited, this vulnerability could cause a kernel panic, resulting in a system crash and potential denial of service. It may also allow unauthorized access to file handles if the race condition is manipulated, though this requires specific conditions to be met.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a Linux kernel issue involving mount namespace handling and does not involve data privacy or security controls typically governed by these regulations.

Mitigation Strategies

Apply the latest Linux kernel security patches to resolve the issue. Monitor kernel logs for mount-related panics and update affected systems immediately.

Hi! I’m here to help you understand CVE-2026-72034. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70