fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace.
Exploitability
AV:LAC:LPR:LUI:NScope
S:UImpact
C:LI:HA:N6.1/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N