CVE Vulnerability Catalog

In the Linux kernel, mnt_change_mountpoint() did not reset the old parent's ->overmount, unlike __umount_mnt(). In the reparent()/propagate_umount() path this led to a dangling pointer and use-after-free when a file descriptor kept an unmounted mount alive, and do_lock_mount() followed ->overmount into the freed mount.

In the Linux kernel, statmount_mnt_basic() read the parent's ids via m->mnt_parent under namespace_sem, which is safe only for mounts in a namespace. For a mount deliberately unmounted and kept alive only by a file descriptor (STATMOUNT_BY_FD), the final mntput() could free the parent concurrently, causing dereference of an already freed mount.

A Linux kernel bug was fixed in clone_mnt(), where the MNT_UMOUNT flag was inherited by cloned mount points. This allowed copies of a lazily unmounted mount (kept alive by an nsfs/pidfs file descriptor) to be created, causing multiple issues: structure leaks, incorrect unmounting of peers, and propagation/reparenting problems. The fix adds MNT_UMOUNT to MNT_INTERNAL_FLAGS so it is never copied.

In the Linux kernel, may_copy_tree() accepted a mount whose root is an nsfs or pidfs file before checking whether that mount is mounted. This exception also admitted a bind mount of such a file after lazy unmount, kept alive only by a file descriptor, so recursive copying (MS_REC/AT_RECURSIVE) copied the entire unmounted mount stack.

A use-after-free vulnerability exists in the Linux kernel mount notification mechanism. mnt_notify_add() does not check whether a mount is already on notify_list, so multiple umount_tree() calls under a single namespace_sem hold can queue the same mount twice and corrupt the list. Subsequent mount operations on the host then walk freed memory.

In the Linux kernel, shrink_submounts() and mark_mounts_for_expiry() first collect mounts to unmount and then unmount them. Unmounting the first mount changes the propagation tree, so the second mount can be unmounted even though it is busy, leaving it marked MNT_SYNC_UMOUNT while still in use. This affects mounts with MNT_SHRINKABLE, such as automounted submounts of NFS, AFS, CIFS, or tracefs under debugfs.

A vulnerability was fixed in the Linux kernel's mount namespace handling, where recursive bind mounts of namespace files (nsfs) could create cyclic dependencies and leak memory. do_loopback() only checked the starting dentry, and with MS_REC it copied namespace files below the source without verifying they don't form loops. This allowed a process in an older mount namespace to repeatedly leak memory by stacking bind mounts.

A vulnerability was fixed in the Linux kernel's open_tree(OPEN_TREE_NAMESPACE) mechanism, which creates a new mount namespace from a copy of the tree at a given path. An unprivileged user could first create a user namespace and then access content hidden by covering mounts (e.g., masking parts of /proc and /sys in container runtimes).

In the Linux kernel, attach_recursive_mnt() preallocates a mountpoint for the root of the topmost mount of the source, but the loop over the mount chain never examines the topmost mount. If the topmost mount is the only mount namespace file in the chain, the existing mount is attached below the root of the mount namespace file (an nsfs dentry), making it unreachable and preventing synchronous unmount. This leads to incorrect behavior of move_mount and umount.

In the Linux kernel, mnt_ns_release() removes fanotify marks of a mount namespace in process context, but mnt_ns_tree_remove() hands the reference to call_rcu(), so marks are removed from RCU softirq. This triggers a "sleeping function called from invalid context" BUG and lockdep warnings about the connector lock. A fanotify group with a FAN_MARK_MNTNS mark on another task's mount namespace is sufficient.

A use-after-free flaw was fixed in the Linux kernel's path_pivot_root() function used by pivot_root(). It read the parent pointer (mnt_parent) of a mount that could already be unmounted and freed while only a file descriptor kept it alive. The check that both mounts belong to the caller's mount namespace now happens before their parents are read.

In the Linux kernel, attach_recursive_mnt() creates a second mountpoint for the root of the source mount without locking the inode, and d_set_mounted() only rejects unlinked dentries. Between detach_mounts() and d_delete() the victim is still hashed, so a bind mount of the directory being removed can be moved beneath an existing mount and never detached. This leaves a mount on a removed directory.

In the Linux kernel, ksys_unshare() calls put_nsproxy() on an nsproxy that was never installed when set_cred_ucounts() fails. This drives the reference counts of the new namespaces from zero to minus one and drops a reference to namespaces shared with the caller. As a result, the namespaces the caller lives in are no longer listed by listns().

In the Linux kernel, d_alloc_pseudo() returns dentries with DCACHE_NORCU that are freed immediately unless they become a mount root. Bind mounting /proc/self/fd/<fd> of such a file (e.g., a BPF token on bpffs) makes such a dentry a mount root, leading to a use-after-free during __follow_mount_rcu(). This can result in access to freed memory.

A race condition exists in the Linux kernel's __detach_mounts() when detaching mounts from a dentry. Between detach_mounts() and d_delete() the dentry remains hashed and positive even though nothing covers it anymore, allowing concurrent lookups to uncover what the mounts hid. This affects unlinking files or directories that are mountpoints in other mount namespaces.

A vulnerability was fixed in the Linux kernel namei refwalk mechanism that could reveal overmounted entries. In a narrow race window between mount detachment and name removal (unlink/rmdir/rename), refwalk could return the underlying entry instead of the mounted content. The fix adds a DCACHE_CANT_MOUNT check after step_into() to detect this case.

The Linux kernel has a flaw in mount namespace handling that allows adding an automount below a mount that is not in the caller's mount namespace. clone_private_mount() sets MNT_NS_INTERNAL, so the validity check passes and count_mounts() dereferences an error pointer, causing a general protection fault. The issue is reachable from userspace via fanotify and occurs while namespace_sem is held for writing, blocking subsequent mount operations system-wide.

The Linux kernel has a flaw in handling locked mounts, which are meant to protect underlying files and directories from being revealed. When a user namespace owner places a mount beneath a locked mount using MOVE_MOUNT_BENEATH, the locked property moves to the bottom mount, allowing the top mount to be unmounted and the covered directory to be revealed. The fix makes plain umount() return EBUSY and lets a locked mount die together with its parent.

A flaw in the Linux kernel's mount locking for automounts across user namespaces was fixed. The user namespace was taken from the caller's mount namespace instead of the namespace where the mount actually lands, causing the lock to be placed on the host's mount rather than the child's copy, preventing the host from changing its own mount flags.

A vulnerability in the Linux kernel mount namespace handling was fixed. attach_recursive_mnt() transferred the MNT_LOCKED flag from the top mount to a mount moved beneath it, allowing a user namespace owner to unlock and unmount a protected /proc or root mount, exposing hidden data.