A dead process-ID namespace could still take new IDs
Brief
The commit does not claim an exploit.
Notes
b64a9f67e082e04835ddd69d422a25168d69375b (Jérémy Jean, ANSSI, 2026-08-11). “pid: reject allocations through dead ancestor pid namespaces.” Fixes: a3bdc23ba8ea. Landed via vfs-7.2-rc8.fixes ad8d485e665829ecbf3c97b22ce251f8ff5f8037.
The old check only ran on the leaf namespace. An unborn descendant could outlive a dead ancestor, get initialized later when someone joined it, and still publish the new ID into the dead ancestor. Freeing that ID then touched accounting on a namespace whose reaper was no longer live.
No linux-cve-announce yet. No Cc: stable. A stable landing is not promised by the commit itself. Do not upgrade this to local privilege escalation.
Commit b64a9f67e082e04835ddd69d422a25168d69375b