Linux Kernel CVE-2026-74343

Exploitation requires a local user account with standard (low) privileges on a Linux system running kernel version 7.1 or earlier in the 7.x series (CVSS PR:L). The critical prerequisite is that unprivileged user namespace creation must be enabled (kernel.unprivileged_userns_clone=1, which is the default on many distributions including Ubuntu and Fedora) so that a low-privileged user can create the namespace contexts needed for multiple superblocks to share a kernfs_node. Beyond account access, the attacker must orchestrate concurrent xattr operations from at least two distinct superblocks that share the same kernfs_node - a condition naturally met on container hosts, Kubernetes worker nodes, or any system using cgroups or sysfs across multiple namespaces simultaneously. Systems with unprivileged_userns_clone=0, or those restricted to a single mount namespace (e.g., minimal embedded Linux with no container workloads), are not exposed to the cross-superblock race. No network access, no user interaction, and no prior exploitation of another vulnerability are required.

The vendor-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local exploitation with low privileges and full-system impact. However, several signals moderate this score in practice. First, the EPSS score of 0.15% at the 5th percentile indicates very low observed or predicted exploitation probability, suggesting that threat actors are not currently weaponizing this class of vulnerability. Second, no CISA KEV listing is present, and no public exploit code has been identified. Third, successful exploitation requires the concurrent timing of xattr operations across multiple superblocks sharing the same kernfs_node - a configuration that is non-trivial to reliably orchestrate and typically limited to container runtimes, Kubernetes nodes, or multi-tenant systems with user namespaces enabled. The nominal AC:L assignment by the vendor is generous; for a race condition dependent on inter-namespace concurrency, AC:H is arguably more accurate. Real-world prioritization should favor container hosts and systems with unprivileged user namespace creation enabled over general-purpose single-user Linux workstations, where the shared-superblock prerequisite is unlikely to occur naturally.

A low-privileged local attacker on a Linux 7.1 host running a container runtime or Kubernetes node creates multiple user namespaces whose kernfs mounts resolve to shared kernfs_node entries. The attacker then spawns concurrent threads that simultaneously invoke setxattr and removexattr on the same kernfs-backed path from different namespace contexts, racing the non-atomic lookup-replace sequence inside simple_xattr_set() to corrupt the shared xattrs structure, potentially overwriting kernel memory or leaking sensitive xattr data from sibling namespaces. No public proof-of-concept exploit is known at time of analysis, and the timing-dependent nature of the race makes reliable exploitation non-trivial.