{"id":12461,"date":"2026-09-04T18:59:25","date_gmt":"2026-09-04T10:59:25","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53341"},"modified":"2026-09-04T18:59:25","modified_gmt":"2026-09-04T10:59:25","slug":"cve-2026-53341","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-53341","title":{"rendered":"CVE-2026-53341 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nfhandle: fix UAF due"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fhandle: fix UAF due to unlocked -&gt;mnt_ns read in may_decode_fh()<\/p>\n<p>may_decode_fh() accesses mount::mnt_ns without holding any locks; that<br \/>\nmeans the mount can concurrently be unmounted, and the mnt_namespace can<br \/>\nconcurrently be freed after an RCU grace period.<\/p>\n<p>This race can happens as follows, assuming that the mount point was<br \/>\ncreated by open_tree(&#8230;, OPEN_TREE_CLONE):<\/p>\n<p>thread 1            thread 2            RCU<br \/>\n                    __do_sys_open_by_handle_at<br \/>\n                      do_handle_open<br \/>\n                        handle_to_path<br \/>\n                          may_decode_fh<br \/>\n                            is_mounted<br \/>\n                              [mount::mnt_ns access]<br \/>\n                            [mount::mnt_ns access]<br \/>\n__do_sys_close<br \/>\n  fput_close_sync<br \/>\n    __fput<br \/>\n      dissolve_on_fput<br \/>\n        umount_tree<br \/>\n        class_namespace_excl_destructor<br \/>\n          namespace_unlock<br \/>\n            free_mnt_ns<br \/>\n              mnt_ns_tree_remove<br \/>\n                call_rcu(mnt_ns_release_rcu)<br \/>\n                                        mnt_ns_release_rcu<br \/>\n                                          mnt_ns_release<br \/>\n                                            kfree<br \/>\n                            [mnt_namespace::user_ns access] **UAF**<\/p>\n<p>Fix it by taking rcu_read_lock() around the mount::mnt_ns access, like<br \/>\nin __prepend_path().<br \/>\nAdditionally, document the semantics of mount::mnt_ns, and use WRITE_ONCE()<br \/>\nfor writers that can race with lockless readers.<\/p>\n<p>This bug is unreachable unless one of the following is set:<\/p>\n<p> &#8211; CONFIG_PREEMPTION<br \/>\n &#8211; CONFIG_RCU_STRICT_GRACE_PERIOD<\/p>\n<p>because it requires an RCU grace period to happen during a syscall without<br \/>\nan explicit preemption.<\/p>\n<p>This doesn&#8217;t seem to have interesting security impact; worst-case, it could<br \/>\nleak the result of an integer comparison to userspace (from the level<br \/>\ncheck in cap_capable()), cause an endless loop, or crash the kernel by<br \/>\ndereferencing an invalid address.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>fhandle: fix UAF due to unlocked -&gt;mnt_ns read in may_decode_fh()<\/p>\n<p>may_decode_fh() accesses mount::mnt_ns without holding any locks<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12461","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12461","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12461"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12461"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12461"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}