The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() may_decode_fh() accesses mount::mnt_ns     without holding any locks; that means the mount can concurrently be unmounted, and the mnt_namespace can     concurrently be freed after an RCU grace period. This race can happens as follows, assuming that the mount     point was created by open_tree(..., OPEN_TREE_CLONE): thread 1 thread 2 RCU __do_sys_open_by_handle_at     do_handle_open handle_to_path may_decode_fh is_mounted [mount::mnt_ns access] [mount::mnt_ns access]
    __do_sys_close fput_close_sync __fput dissolve_on_fput umount_tree class_namespace_excl_destructor     namespace_unlock free_mnt_ns mnt_ns_tree_remove call_rcu(mnt_ns_release_rcu) mnt_ns_release_rcu     mnt_ns_release kfree [mnt_namespace::user_ns access] **UAF** Fix it by taking rcu_read_lock() around the     mount::mnt_ns access, like in __prepend_path(). Additionally, document the semantics of mount::mnt_ns, and     use WRITE_ONCE() for writers that can race with lockless readers. This bug is unreachable unless one of     the following is set: - CONFIG_PREEMPTION - CONFIG_RCU_STRICT_GRACE_PERIOD because it requires an RCU     grace period to happen during a syscall without an explicit preemption. This doesn't seem to have     interesting security impact; worst-case, it could leak the result of an integer comparison to userspace     (from the level check in cap_capable()), cause an endless loop, or crash the kernel by dereferencing an     invalid address. (CVE-2026-53341)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-53341

medium Nessus Plugin ID 324667

Version 1.3