CVE-2026-72034

In the Linux kernel, the following vulnerability has been resolved:

fhandle: reject detached mounts in capablewrtmount()

The recent fhandle RCU fix moved the mount namespace capability check into capablewrtmount(), so a non-NULL mntnamespace survives the nscapable() dereference. The helper still assumes the later READONCE(mount->mntns) must be non-NULL because maydecodefh() checked is_mounted() first.

That assumption is not stable. A detached mount from opentree(..., OPENTREECLONE) can be dissolved on fput while openbyhandleat() is between those checks, and umounttree() can clear mount->mntns. If the helper observes NULL, it dereferences mntns->userns and panics.

Return false when the RCU read observes a detached mount. This keeps the relaxed permission path conservative: a mount no longer attached to a namespace cannot authorize openbyhandle_at() access.