CVE-2026-53341

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()

may_decode_fh() accesses mount::mnt_ns without holding any locks; that

means the mount can concurrently be unmounted, and the mnt_namespace can

concurrently be freed after an RCU grace period.

This race can happens as follows, assuming that the mount point was

created by open_tree(..., OPEN_TREE_CLONE):

thread 1 thread 2 RCU

__do_sys_open_by_handle_at

do_handle_open

handle_to_path

may_decode_fh

is_mounted

[mount::mnt_ns access]

[mount::mnt_ns access]

__do_sys_close

fput_close_sync

__fput

dissolve_on_fput

umount_tree

class_namespace_excl_destructor

namespace_unlock

free_mnt_ns

mnt_ns_tree_rem

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References