Executive brief
A vulnerability was identified in the Linux kernel's file system management component. The issue occurs when the system lists mounted file systems, potentially leading to a system crash or unstable behavior if certain internal resources are released at the wrong time. This could allow a local user to disrupt system operations or potentially gain unauthorized access to sensitive information.
Technical details
The vulnerability exists in the listmount() system call implementation within fs/namespace.c. The root cause is the invocation of path_put() while the namespace_sem (semaphore) is held. If path_put() releases the final reference to a mount point under this lock, it can trigger a deadlock or use-after-free scenario. An attacker with local access can exploit this by triggering the listmount() syscall under specific conditions to cause a kernel crash or escalate privileges. The fix involves refactoring listmount() to ensure path_put() is called outside the critical section protected by the namespace semaphore.
Affected products
- Linux Linux 6.8 to 6.12.53, 6.17.3
Timeline
- 2025-11-12: advisory
- 2025-11-12: disclosed