Executive brief
A vulnerability was identified in the Linux kernel's file handle decoding logic. Under specific system configurations, a race condition could allow a local user to trigger a system crash or potentially leak minor internal information. This occurs when the system attempts to verify permissions for a file mount that is simultaneously being unmounted.
Technical details
A use-after-free (UAF) vulnerability exists in fs/fhandle.c within the may_decode_fh() function. The root cause is an unlocked read of mount::mnt_ns, which allows a race condition where a mount point is unmounted and its namespace is freed via RCU while still being accessed. This vulnerability is only reachable on kernels compiled with CONFIG_PREEMPTION or CONFIG_RCU_STRICT_GRACE_PERIOD. An attacker could potentially cause a kernel oops (denial of service), an infinite loop, or a minor information leak of integer comparison results from cap_capable(). The issue has been resolved by implementing rcu_read_lock() around the affected access and using WRITE_ONCE() for writers.
Affected products
- Linux Linux Kernel 6.11 to 6.18.36, 7.0.13, 7.1
Timeline
- 2026-06-03: disclosed: Vulnerability reported by Jann Horn
- 2026-06-19: patched: Fix committed to stable tree
- 2026-07-01: advisory: CVE-2026-53341 published