CVE-2026-72034
In the Linux kernel, the following vulnerability has been resolved: fhandle: reject detached mounts in capable_wrt_mount() The recent fhandle RCU fix moved the mount namespace capability check into capable_wrt_mount(), so a non-NULL mnt_namespace survives the ns_capable() dereference. The helper still assumes the later READ_ONCE(mount->mnt_ns) must be non-NULL because may_decode_fh() checked is_mounted() first. That assumption is not stable. A detached mount from open_tree(..., OPEN_TREE_CLONE) can be dissolved on fput while open_by_handle_at() is between those checks, and umount_tree() can clear mount->mnt_ns. If the helper observes NULL, it dereferences mnt_ns->user_ns and panics. Return false when the RCU read observes a detached mount. This keeps the relaxed permission path conservative: a mount no longer attached to a namespace cannot authorize open_by_handle_at() access.
Affected versions
Linux kernel versions
6.11
and later are affected. Fixed in
6.12.97,
6.18.40,
7.1.5,
7.2-rc2
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-72034?
CVE-2026-72034 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.11 onward and has been patched in 6.12.97, 6.18.40, 7.1.5 and others. CVE-2026-72034 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72034?
Yes. CVE-2026-72034 has been patched. Fixed versions include 6.12.97, 6.18.40, 7.1.5 and others. If you are running Linux kernel 6.11 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72034 actively exploited?
No. CVE-2026-72034 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.