The Linux kernel overlay filesystem (ovl) had a vulnerability where a WARN_ON() was triggered if a mount was completed from a different user namespace than the one that created the fscontext. The fsopen() syscall records the caller's user namespace in the fscontext, but fsconfig() does not verify that the task issuing FSCONFIG_CMD_CREATE is the same as the one that created the context. This allows an unprivileged user to create a user and mount namespace, open an overlay fscontext in the child, pass the file descriptor to the parent, and cause the WARN_ON() in ovl_fill_super(). Because WARN_ON() is not limited to once, this can be triggered repeatedly, tainting the kernel and flooding logs. On kernels with panic_on_warn enabled, this can cause a panic. The fix involves refusing the mount and removing the warning condition.

An unprivileged user can cause kernel warnings repeatedly by completing a mount from another user namespace, leading to kernel taint and log flooding. On systems with panic_on_warn enabled, this can cause a kernel panic, impacting system stability. There is no indication of privilege escalation or code execution from this vulnerability.

A fix has been implemented that refuses the mount and stops the warning from occurring. Users should apply the official kernel update that includes this fix. Until patched, systems with panic_on_warn enabled should consider disabling this option to prevent kernel panics from this WARN_ON() condition.