Linux Kernel EUVD-2026-108772

Requires local access plus the ability to create an unprivileged user namespace (CONFIG_USER_NS with unprivileged user-ns creation permitted, as on default Debian/Ubuntu) and a kernel supporting the MOVE_MOUNT_BENEATH mount flag. The concrete prerequisite chain is: own a user namespace, place a shrinkable mount beneath a locked mount via MOVE_MOUNT_BENEATH so the locked property migrates to the bottom mount, then umount/expire the unlocked ancestor so shrink_submounts()/mark_mounts_for_expiry() unmaps the locked bottom mount and uncovers the hidden directory. LIMITING FACTORS: no remote vector (AV:L) and no path for unauthenticated use (PR:L authenticated local user); hosts that disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 or seccomp/container policy) remove the primary entry point; only kernels implementing MOVE_MOUNT_BENEATH are affected. Per the advisory the complete fix is the vendor patch that refuses to expire locked mounts (a plain umount of an unlocked mount with a locked child now returns EBUSY).

The signals point to a real but bounded local privilege/isolation issue rather than a mass-exploitation emergency. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 8.4) describes a local, low-complexity, low-privilege attack with a scope change, which is consistent with a container/namespace boundary escape: an unprivileged local user who can create a user namespace abuses MOVE_MOUNT_BENEATH to relocate a locked mount and then expire it, revealing files the lock was meant to hide. EPSS is low (0.21%, 10th percentile) and the vuln is NOT in CISA KEV, with no public exploit identified, so there is no evidence of widespread or active exploitation - the vuln.today 'this_week' decision label reflects a fix-promptly priority, not act_now/emergency. The high base score is driven almost entirely by the scope change and confidentiality/integrity impact on protected files, but exploitation is gated by local access and unprivileged-user-namespace availability. Note a tension in the input: the vector lists I:H, yet the described effect is disclosure of covered/protected directory content (an information-disclosure/isolation-bypass primitive), so the integrity rating is debatable - verify impact with the upstream commit messages. Overall: a legitimate security-boundary bug worth patching on a normal cadence, not a high-CVSS-but-no-real-risk item and not an internet-facing emergency.

A local unprivileged user on a multi-tenant or container host creates a user namespace, uses MOVE_MOUNT_BENEATH to slide a shrinkable mount beneath a locked mount, and then triggers umount/expiry of the unlocked ancestor; the locked mount dies and the previously hidden directory is exposed, letting the attacker read protected content (e.g. files masked by the lock). No public exploit code is identified at time of analysis, but the reproduction steps are spelled out in the advisory description. The CVSS AV:L/AC:L indicates reliable local triggering once unprivileged user namespaces are available.