{"id":"CVE-2026-53341","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nfhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()\n\nmay_decode_fh() accesses mount::mnt_ns without holding any locks; that\nmeans the mount can concurrent…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()\n\nmay_decode_fh() accesses mount::mnt_ns without holding any locks; that\nmeans the mount can concurrent…","severity":"high","published":"2026-07-01","updated":"2026-07-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53341","references":[{"url":"https://git.kernel.org/stable/c/15ea8dc42a02259d49dee38a658d40f60fcd75ed","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/32138633e51e6db59e474765cf93268c92b42888","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40ab6644b99685755f740b872c00ef40d9aa870e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8ed2c29fcfdac78db96c9da4e659c8a513f2a94","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53341.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-53341"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2495938"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53341"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53341"},{"url":"https://lore.kernel.org/linux-cve-announce/2026070144-CVE-2026-53341-64ff@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:72624"},{"url":"https://access.redhat.com/errata/RHSA-2026:72623"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00127,"epssPercentile":0.02348,"ingestedAt":"2026-07-04T13:56:12.017Z","vendor":"Red Hat","product":"Red Hat Enterprise Linux BaseOS (v. 10)","affected":["enterprise_linux 6","enterprise_linux 9","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_real_time_v_9"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_codeready_linux_builder_v_9","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_for_nfv_v_9","enterprise_linux_real_time_v_10","enterprise_linux_real_time_v_9"],"cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":["CWE-364"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:28:32.016897Z"},"scores":{"vendor":7,"cna":7.8},"slug":"CVE-2026-53341","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()\n\nmay_decode_fh() accesses mount::mnt_ns without holding any locks; that\nmeans the mount can concurrently be unmounted, and the mnt_namespace can\nconcurrently be freed after an RCU grace period.\n\nThis race can happens as follows, assuming that the mount point was\ncreated by open_tree(..., OPEN_TREE_CLONE):\n\nthread 1            thread 2            RCU\n                    __do_sys_open_by_handle_at\n                      do_handle_open\n                        handle_to_path\n                          may_decode_fh\n                            is_mounted\n                              [mount::mnt_ns access]\n                            [mount::mnt_ns access]\n__do_sys_close\n  fput_close_sync\n    __fput\n      dissolve_on_fput\n        umount_tree\n        class_namespace_excl_destructor\n          namespace_unlock\n            free_mnt_ns\n              mnt_ns_tree_remove\n                call_rcu(mnt_ns_release_rcu)\n                                        mnt_ns_release_rcu\n                                          mnt_ns_release\n                                            kfree\n                            [mnt_namespace::user_ns access] **UAF**\n\nFix it by taking rcu_read_lock() around the mount::mnt_ns access, like\nin __prepend_path().\nAdditionally, document the semantics of mount::mnt_ns, and use WRITE_ONCE()\nfor writers that can race with lockless readers.\n\nThis bug is unreachable unless one of the following is set:\n\n - CONFIG_PREEMPTION\n - CONFIG_RCU_STRICT_GRACE_PERIOD\n\nbecause it requires an RCU grace period to happen during a syscall without\nan explicit preemption.\n\nThis doesn't seem to have interesting security impact; worst-case, it could\nleak the result of an integer comparison to userspace (from the level\ncheck in cap_capable()), cause an endless loop, or crash the kernel by\ndereferencing an invalid address.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:72624** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72624)\n- **RHSA-2026:72623** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72623)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53341.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":212450,"id":"CVE-2026-53341","ts":1790668182892,"field":"cvss","old":null,"new":"7"},{"seq":212449,"id":"CVE-2026-53341","ts":1790668182892,"field":"severity","old":"none","new":"high"}]}