Linux Kernel CVE-2026-97971

Requires local execution of the listns() syscall on a kernel new enough to include the nstree namespace-listing infrastructure (introduced at commit 76b6f5dfb3fd; present in Linux 6.19/7.x, e.g. the 7.0.0-30-generic Ubuntu build in the splat). The bug is reached on the permission-denied path where may_list_ns() refuses a candidate mount namespace whose last reference is then dropped under the RCU read lock. Limiting factors: the vulnerable listns()/nstree code exists only in bleeding-edge kernels, so nearly all production LTS/stable deployments are unaffected; impact is confined to a kernel warning/voluntary-context-switch (most impactful with PREEMPT), and requires an already-authenticated local user (PR:L) with no confidentiality or integrity consequence.

This is a local, low-complexity denial-of-service bug in the Linux kernel's new nstree/listns() namespace-listing infrastructure. The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is overstated: the described defect is a sleep-in-atomic violation - legitimize_ns() takes a namespace reference before may_list_ns() authorizes visibility, and the denied-path __free(ns_put) cleanup can drop the last reference to a mount namespace while the RCU read lock is still held, causing put_mnt_ns() → namespace_unlock() → synchronize_rcu_expedited() to sleep inside an RCU read-side critical section. The splat is a WARNING/voluntary-context-switch, i.e. a stability/DoS impact under PREEMPT, not a confidentiality or integrity compromise, so the claimed C:H/I:H is not supported by the description. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so exploitation status is: no public exploit identified at time of analysis. SSVC framework data was not provided. Net real-world priority is LOW-to-MODERATE: it is locally triggerable by an unprivileged user but yields only a crash/hang on a very new kernel line, not code execution or data theft. Note the conflict: the 'Information Disclosure' tag contradicts the actual sleep-in-atomic/DoS nature of the flaw (C should be N).

A local unauthenticated-to-the-box but logged-in unprivileged user (the reproducer runs as UID 1000) invokes the listns() syscall in a way that hits the permission-denied path for a candidate mount namespace. The kernel drops the last namespace reference while still holding the RCU read lock, sleeps in synchronize_rcu_expedited(), and triggers a warning/hang, degrading or crashing the system. No public proof-of-concept is identified in the provided data, though the description includes a full kernel splat.