{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.95-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.13-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  fhandle: fix UAF due to unlocked -\u003emnt_ns read in may_decode_fh()  may_decode_fh() accesses mount::mnt_ns without holding any locks; that means the mount can concurrently be unmounted, and the mnt_namespace can concurrently be freed after an RCU grace period.  This race can happens as follows, assuming that the mount point was created by open_tree(..., OPEN_TREE_CLONE):  thread 1            thread 2            RCU                     __do_sys_open_by_handle_at                       do_handle_open                         handle_to_path                           may_decode_fh                             is_mounted                               [mount::mnt_ns access]                             [mount::mnt_ns access] __do_sys_close   fput_close_sync     __fput       dissolve_on_fput         umount_tree         class_namespace_excl_destructor           namespace_unlock             free_mnt_ns               mnt_ns_tree_remove                 call_rcu(mnt_ns_release_rcu)                                         mnt_ns_release_rcu                                           mnt_ns_release                                             kfree                             [mnt_namespace::user_ns access] **UAF**  Fix it by taking rcu_read_lock() around the mount::mnt_ns access, like in __prepend_path(). Additionally, document the semantics of mount::mnt_ns, and use WRITE_ONCE() for writers that can race with lockless readers.  This bug is unreachable unless one of the following is set:   - CONFIG_PREEMPTION  - CONFIG_RCU_STRICT_GRACE_PERIOD  because it requires an RCU grace period to happen during a syscall without an explicit preemption.  This doesn't seem to have interesting security impact; worst-case, it could leak the result of an integer comparison to userspace (from the level check in cap_capable()), cause an endless loop, or crash the kernel by dereferencing an invalid address.",
  "id": "DEBIAN-CVE-2026-53341",
  "modified": "2026-09-14T16:47:49.249051623Z",
  "published": "2026-07-01T14:16:42.143Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-53341"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-53341"
  ]
}