CVE-2026-53341: Linux Kernel File Handle Use-After-Free via Race Condition

Technical summary

The vulnerability exists in may_decode_fh(), which reads the mount::mnt_ns field without holding locks. When a mount created via OPEN_TREE_CLONE is concurrently unmounted, the mnt_namespace structure can be freed via RCU callback while may_decode_fh() is still dereferencing it, leading to a use-after-free. The race window exists between the initial mount::mnt_ns access and subsequent accesses to mnt_namespace::user_ns. The fix involves protecting mount::mnt_ns accesses with rcu_read_lock(), consistent with similar patterns in __prepend_path(). Additionally, writers use WRITE_ONCE() to prevent compiler optimizations that could widen the race window.

Business impact

For production Linux systems, the primary risk is kernel availability. Successful exploitation can cause a denial-of-service through kernel crash. The likelihood of accidental triggering is low without CONFIG_PREEMPTION or CONFIG_RCU_STRICT_GRACE_PERIOD, but systems with these options enabled face elevated risk. The confidentiality impact (potential integer comparison leakage) is minimal and architectural in nature rather than exposing high-value secrets.

Affected systems

All versions of the Linux kernel are potentially affected. Practical exploitation requires either CONFIG_PREEMPTION=y or CONFIG_RCU_STRICT_GRACE_PERIOD=y at compile time. This includes most distribution kernels with preemption enabled (typical for desktop and server builds) and any kernel with strict RCU grace period enforcement. The vulnerability is reachable only when users exercise the open_tree(OPEN_TREE_CLONE) syscall path concurrent with mount operations.

Exploitability

Direct exploitation requires local access and the ability to trigger specific syscall sequences: opening a file handle on a cloned mount while concurrently triggering unmount from another thread. No known public exploit exists (KEV status is not added). The race window is narrow and timing-dependent, though the precise alignment depends on system load and scheduling. This is a logical race rather than a trivial overflow, making practical weaponization moderately difficult but not impossible for a motivated threat actor with system access.

Remediation

Apply the kernel patch that wraps mount::mnt_ns accesses in rcu_read_lock()/rcu_read_unlock() critical sections and adds WRITE_ONCE() annotations for concurrent writers. Verify the patch against the upstream Linux repository for your kernel version. For interim mitigation on non-critical systems, disabling CONFIG_PREEMPTION (if operationally feasible) eliminates the practical race condition, though this is not recommended as a long-term strategy.

Patch guidance

Patch availability depends on your kernel distribution and version. Check your vendor's security advisories for specific patch versions and release dates. Upstream fixes are available in the Linux kernel repository. Most major distributions (Red Hat, Canonical, SUSE, Debian) have issued or will issue updates. Prioritize systems running preemptible kernels or with strict RCU grace periods. Test patches in a staging environment before production rollout to ensure no regressions in mount and file handle behavior.

Detection guidance

Monitor kernel logs for UAF-related crashes (KASAN warnings, segmentation faults in may_decode_fh or related functions). System administrators can profile syscall sequences involving open_by_handle_at() and concurrent unmounts using ftrace or eBPF. Watch for 'mnt_namespace' or 'mnt_ns' in crash dumps. Enable kernel address sanitizer (KASAN) in test/pre-production environments for earlier detection. No userspace signature-based detection is practical; focus remains on kernel instrumentation and log analysis.

Why prioritize this

This vulnerability rates HIGH (CVSS 7.8) due to its impact on system availability and the wide deployment of Linux kernels with preemption. Although exploitation requires local access and specific timing, the consequences (kernel crash affecting all users) justify rapid patching. The narrow window and race-condition nature make it less immediately critical than memory corruption vulnerabilities, but it still merits priority in patching cycles for preemption-enabled systems.

Risk score, explained

CVSS 3.1 score of 7.8 reflects: Attack Vector (Local) — requires local access; Attack Complexity (Low) — no special conditions beyond kernel config; Privileges Required (Low) — any local user can trigger the race; User Interaction (None); Scope (Unchanged); Confidentiality (High) — potential integer leak; Integrity (High) — kernel state corruption possible; Availability (High) — kernel crash likely upon successful race. The score appropriately captures the availability impact and the low barrier to privilege escalation from user context.

Frequently asked questions