CVE-2026-53341

In the Linux kernel, the following vulnerability has been resolved:

fhandle: fix UAF due to unlocked ->mntns read in maydecode_fh()

maydecodefh() accesses mount::mntns without holding any locks; that means the mount can concurrently be unmounted, and the mntnamespace can concurrently be freed after an RCU grace period.

This race can happens as follows, assuming that the mount point was created by opentree(..., OPENTREE_CLONE):

thread 1 thread 2 RCU __dosysopenbyhandleat dohandleopen handletopath maydecodefh ismounted [mount::mntns access] [mount::mntns access] __dosysclose fputclosesync _fput dissolveonfput umounttree classnamespaceexcldestructor namespaceunlock freemntns mntnstreeremove callrcu(mntnsreleasercu) mntnsreleasercu mntnsrelease kfree [mntnamespace::userns access] UAF

Fix it by taking rcureadlock() around the mount::mnt_ns access, like in _prependpath(). Additionally, document the semantics of mount::mntns, and use WRITEONCE() for writers that can race with lockless readers.

This bug is unreachable unless one of the following is set:

• CONFIG_PREEMPTION
• CONFIGRCUSTRICTGRACEPERIOD

because it requires an RCU grace period to happen during a syscall without an explicit preemption.

This doesn't seem to have interesting security impact; worst-case, it could leak the result of an integer comparison to userspace (from the level check in cap_capable()), cause an endless loop, or crash the kernel by dereferencing an invalid address.