Skip to main content

Linux Kernel CVE-2026-72034

| EUVDEUVD-2026-58992 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-g7v4-chcg-vj96
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.7 MEDIUM

Race condition requires precise timing between fput() and open_by_handle_at() warranting AC:H; demonstrated impact is kernel panic only, so C:N and I:N with A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 06:25 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fhandle: reject detached mounts in capable_wrt_mount()

The recent fhandle RCU fix moved the mount namespace capability check into capable_wrt_mount(), so a non-NULL mnt_namespace survives the ns_capable() dereference. The helper still assumes the later READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh() checked is_mounted() first.

That assumption is not stable. A detached mount from open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while open_by_handle_at() is between those checks, and umount_tree() can clear mount->mnt_ns. If the helper observes NULL, it dereferences mnt_ns->user_ns and panics.

Return false when the RCU read observes a detached mount. This keeps the relaxed permission path conservative: a mount no longer attached to a namespace cannot authorize open_by_handle_at() access.

AnalysisAI

Null pointer dereference in the Linux kernel's fhandle subsystem allows a local low-privileged user to trigger a kernel panic via a race condition in capable_wrt_mount(). The vulnerable path is reached when open_by_handle_at() processes a file handle whose detached mount - created via open_tree(OPEN_TREE_CLONE) - is concurrently dissolved by fput(), causing umount_tree() to clear mount->mnt_ns to NULL before capable_wrt_mount() can safely dereference mnt_ns->user_ns. No public exploit identified at time of analysis (EPSS 0.20%, no CISA KEV listing), and patched kernel versions 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2 are available from upstream stable trees.

Technical ContextAI

The Linux kernel's open_by_handle_at() syscall decodes a stored file handle into a file descriptor, relying on may_decode_fh() and capable_wrt_mount() for mount namespace capability checks. A recent fhandle RCU fix relocated the ns_capable() check into capable_wrt_mount(), which reads mount->mnt_ns under RCU and assumed non-NULL because may_decode_fh() had already verified is_mounted(). That assumption is not stable: open_tree(OPEN_TREE_CLONE) creates a detached mount clone not yet bound to a persistent namespace, and when fput() on that clone triggers umount_tree(), mount->mnt_ns is cleared to NULL asynchronously. If capable_wrt_mount() observes NULL between the is_mounted() guard in may_decode_fh() and the READ_ONCE in capable_wrt_mount(), dereferencing mnt_ns->user_ns causes an immediate kernel panic. CWE is formally unassigned, but the root cause maps to CWE-476 (NULL Pointer Dereference) with a concurrent CWE-362 (Race Condition) component introduced by the RCU-era restructuring. Affected stable series are confirmed via EUVD-2026-58992 across the 6.11, 6.12, 6.18, 7.1, and 7.2 kernel trees.

RemediationAI

Upgrade the Linux kernel to a vendor-released patched version: 6.12.97, 6.18.40, 7.1.5, or 7.2-rc2, as confirmed by EUVD-2026-58992. Stable fix commits are available at https://git.kernel.org/stable/c/15104234c267ebe04b9f9a73e5c2179cc265ff60, https://git.kernel.org/stable/c/6c52226072a3c61337b1eec1799bb987748884fa, https://git.kernel.org/stable/c/6c732471740bc2ac9b0946134f9f551dc75f4369, and https://git.kernel.org/stable/c/6ee183d89261bf1d1cf9f06d80a40dab8f36ee55. Where immediate kernel upgrade is not feasible, restrict the open_tree() and open_by_handle_at() syscalls for unprivileged users via seccomp-bpf profiles, SELinux policy, or AppArmor rules - this eliminates the attack surface by preventing creation of OPEN_TREE_CLONE detached mounts. Note that blocking open_tree() may disrupt container runtimes such as runc and containerd, as well as filesystem utility tools that rely on mount namespace cloning; validate in a staging environment before broad deployment. Disabling CONFIG_FHANDLE at kernel build time also eliminates the entire code path, but requires a custom kernel build and removes legitimate file-handle-based functionality.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72034 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy