---
id: CVE-2026-72034
title: 'fhandle: reject detached mounts in capable_wrt_mount()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fhandle: reject detached mounts in capable_wrt_mount()

  The recent fhandle RCU fix moved the mount namespace capability check
  into capable_wrt_mount(), so a non-NULL mn…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 620c266f394932e5decc4b34683a75dfc59dc2f4 <
    15104234c267ebe04b9f9a73e5c2179cc265ff60
  - >-
    Linux >= 620c266f394932e5decc4b34683a75dfc59dc2f4 <
    6c52226072a3c61337b1eec1799bb987748884fa
  - >-
    Linux >= 620c266f394932e5decc4b34683a75dfc59dc2f4 <
    6ee183d89261bf1d1cf9f06d80a40dab8f36ee55
  - >-
    Linux >= 620c266f394932e5decc4b34683a75dfc59dc2f4 <
    6c732471740bc2ac9b0946134f9f551dc75f4369
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:50:22.071900Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:17.001Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72034'
references:
  - url: 'https://git.kernel.org/stable/c/15104234c267ebe04b9f9a73e5c2179cc265ff60'
  - url: 'https://git.kernel.org/stable/c/6c52226072a3c61337b1eec1799bb987748884fa'
  - url: 'https://git.kernel.org/stable/c/6ee183d89261bf1d1cf9f06d80a40dab8f36ee55'
  - url: 'https://git.kernel.org/stable/c/6c732471740bc2ac9b0946134f9f551dc75f4369'
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.06557
ingestedAt: '2026-10-16T17:24:46.871Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fhandle: reject detached mounts in capable_wrt_mount()

The recent fhandle RCU fix moved the mount namespace capability check
into capable_wrt_mount(), so a non-NULL mnt_namespace survives the
ns_capable() dereference. The helper still assumes the later
READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh()
checked is_mounted() first.

That assumption is not stable. A detached mount from
open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while
open_by_handle_at() is between those checks, and umount_tree() can
clear mount->mnt_ns. If the helper observes NULL, it dereferences
mnt_ns->user_ns and panics.

Return false when the RCU read observes a detached mount. This keeps
the relaxed permission path conservative: a mount no longer attached
to a namespace cannot authorize open_by_handle_at() access.

## Affected

- `Linux >= 620c266f394932e5decc4b34683a75dfc59dc2f4 < 15104234c267ebe04b9f9a73e5c2179cc265ff60`
- `Linux >= 620c266f394932e5decc4b34683a75dfc59dc2f4 < 6c52226072a3c61337b1eec1799bb987748884fa`
- `Linux >= 620c266f394932e5decc4b34683a75dfc59dc2f4 < 6ee183d89261bf1d1cf9f06d80a40dab8f36ee55`
- `Linux >= 620c266f394932e5decc4b34683a75dfc59dc2f4 < 6c732471740bc2ac9b0946134f9f551dc75f4369`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.