Executive brief
The Linux kernel's binfmt_misc module contains a warning that can be triggered repeatedly by unprivileged users crossing user namespaces, allowing them to flood system logs and potentially crash systems configured to panic on warnings. This does not grant elevated privileges but disrupts system stability and log integrity through denial-of-service.
Technical details
The vulnerability is a WARN_ON() condition in bm_fill_super() (fs/binfmt_misc.c:938) that fires when a filesystem context is completed from a different user namespace than the one that created it. An unprivileged attacker can trigger this by creating a child process with unshared user and mount namespaces, calling fsopen("binfmt_misc") in the child, passing the file descriptor to the parent via a unix socket, and having the parent issue FSCONFIG_CMD_CREATE. Because the check uses WARN_ON() rather than WARN_ON_ONCE(), the condition can be raised repeatedly in a loop to taint the kernel, flood logs, or trigger a kernel panic on systems with panic_on_warn enabled. No elevated capabilities are required—the attack relies on namespace isolation features already available to unprivileged users. The fix is to replace the warning with a silent refusal of the mount.
Affected products
- Linux Linux kernel affected versions unspecified
Timeline
- 2026-08-22: disclosed