Executive brief
The Linux kernel's file handle (fhandle) subsystem contains a null pointer dereference vulnerability in the capable_wrt_mount() function. A local attacker can trigger a kernel panic by creating a detached mount using open_tree() and then accessing files via open_by_handle_at() while the mount is being dissolved. This causes denial of service, making the system unavailable.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in fs/fhandle.c within the capable_wrt_mount() function. The function assumes that a mount's mnt_ns field remains non-NULL after an earlier is_mounted() check in may_decode_fh(), but this assumption is not race-safe. A detached mount created via open_tree(..., OPEN_TREE_CLONE) can have its mnt_ns cleared by umount_tree() while open_by_handle_at() is executing between the two checks. When capable_wrt_mount() then dereferences the NULL mnt_ns->user_ns pointer, the kernel panics. The fix adds a NULL check before dereferencing: `return mnt_ns && ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN)`. The fix is available in recent Linux kernel stable branches.
Affected products
- Linux Linux Kernel multiple versions (see kernel stable trees)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched