The Linux kernel's binfmt_misc subsystem had a vulnerability where fsopen() records the user namespace of the caller in the fscontext, but fsconfig(FSCONFIG_CMD_CREATE) does not verify that the caller matches the creator's namespace. This allows an unprivileged user to create a user and mount namespace in a child process, open a binfmt_misc fscontext there, send the file descriptor to a parent process, and trigger WARN_ON() warnings in bm_fill_super() repeatedly. These warnings can taint the kernel, flood logs, and cause a kernel panic if panic_on_warn is set. The fix involves refusing the mount and suppressing the warnings, as bm_fill_super() does not depend on matching namespaces.

Unprivileged users can cause repeated kernel warnings (WARN_ON()) by exploiting the mismatch in user namespaces during binfmt_misc mounts. This can lead to kernel tainting, log flooding, and potential kernel panic on systems configured with panic_on_warn. There is no indication of privilege escalation or arbitrary code execution from this issue.

A fix has been implemented in the Linux kernel to refuse mounts that trigger these warnings and to stop warning about them. Users should update to a kernel version that includes this fix. Since this is a kernel-level issue, patching the kernel is the recommended remediation. No additional mitigations are indicated.