The criu project today released 4.1.1 as bufix release containing one
single fix:

| This release of CRIU (4.1.1) addresses a critical compatibility issue
| introduced in the Linux kernel and back-ported to all stable releases.
|
| The kernel commit (12f147ddd6de "do_change_type(): refuse to operate on
| unmounted/not ours mounts") addressed the security issue introduced
| almost 20 years ago. Unfortunately, this change inadvertently broke the
| restore functionality of mount namespaces within CRIU. Users attempting
| to restore a container on updated kernels would encounter the error:
| "mnt-v2: Failed to make mount 476 slave: Invalid argument."
|
| This release contains the necessary adjustments to CRIU, allowing it to
| work seamlessly with kernels incorporating this security change.

https://github.com/checkpoint-restore/criu/releases/tag/v4.1.1

The kernel change is a security fix which was backported to all stable
eseries, and in particular for Debian relevant as 6.1.142 (not yet
released but will be soon as DSA), 6.12.34 in trixie.

The fix should land ideally in trixie, but I'm awaere that the last
posibiltiy for unblocks is just around the corner.

I'm right now verifying the fix and filling this bug already for
transparency.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
criu, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1110096@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated criu package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 29 Jul 2025 20:37:31 +0200
Source: criu
Architecture: source
Version: 4.1.1-1
Distribution: unstable
Urgency: medium
Maintainer: Salvatore Bonaccorso <carnil@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1110096
Changes:
 criu (4.1.1-1) unstable; urgency=medium
 .
   * New upstream version 4.1.1
     - mount-v2: enter the mount namesapce to propagation properties
       (Closes: #1110096)
Checksums-Sha1:
 8de5b862db52c2e1ef0fc28acffebcaac9edfeaa 2806 criu_4.1.1-1.dsc
 fd070609736ec795b2272641ef4b88d61e93ac2c 1021136 criu_4.1.1.orig.tar.xz
 d112f70bd100c3d06b9fbb52a974f230e18451f4 12368 criu_4.1.1-1.debian.tar.xz
Checksums-Sha256:
 12206f74ab852907156db8fdf1fb2a40ebbc897d28c133a2cbe804fab13f8b62 2806 criu_4.1.1-1.dsc
 f80a66cb3726bb2116266d4759ce3bcbfab7abdb6b6d430bf20dd41911717afe 1021136 criu_4.1.1.orig.tar.xz
 103855d69544c3417abdb5b309c1773db98af2293c4dc48bba39e244b85c778e 12368 criu_4.1.1-1.debian.tar.xz
Files:
 b76fc936ca0591d50d299348b03875e9 2806 admin optional criu_4.1.1-1.dsc
 6de15517e9b86997b34f67d99dced2a5 1021136 admin optional criu_4.1.1.orig.tar.xz
 b461ee9e2cd47a03b881637b2dc8e7d7 12368 admin optional criu_4.1.1-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmiJOPxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89Eel0P/3a2+PlKkBAJo1Hn5w3EIO2GANEIc3En
tu8mGxaBRZ6ilhLFXMHMwQgI3FRLTcyOjbk4ewPGSC/GqUxznYSfZVCqNiNGmNIW
e82bs4VzRBsdcFcKDwvaPUALQmV2yC79ReZ1m6igYyIiECzVdDjkAacCuvFdSQR1
MvMaX55mL/7IaETsosug9qcWsu2CH2EmYnxO6sLHuKGQRXFlzM/klQy37R48dkN2
XXsY4O5GxEs3KYgFVJCN1KhuFK4yKtbvUiQGG2fvQiaA7LOoH3D9eK/yCmztQzEg
ujJOk/PPdhoVg+c+UGoPeIS7L7Ut0jCJjVZwfrgQdfNOKxup7yWqaaXPLCZA81lG
X+gdDNGByK0hAuA+Q8hrkACvXFvcJlRyz8ZVDoshPkj3XCRDZ04bKqboSXSHKThT
kIJL00Z/aTs5yRY21GglsU+uFYgyOoTYw6F+Z/XwcGiwf+IX/QBjSb5nl4Ho9lZE
Ssb6PWskMf9g2AJJVQC2qncZBpwU5hmx/NP1gzupQ5Ohl41/7kqKfvUehwNju+zq
U0TXeFcJN9aIg+/pvMVUXrNv/3DISeBtHwrhicvRE9wi6wy21b4OtOlx7Bam4sbw
4NpSnvKIMv9/WsrblFqYAyhsdyXTVFmuozUAbCOE9v6digGtQ5AgnJ2ouzLOmlV/
7gwSqAVNpRQd
=+Xhn
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
criu, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1110096@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated criu package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 24 Aug 2025 15:12:30 +0200
Source: criu
Architecture: source
Version: 3.17.1-2+deb12u2
Distribution: bookworm
Urgency: medium
Maintainer: Salvatore Bonaccorso <carnil@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1110096
Changes:
 criu (3.17.1-2+deb12u2) bookworm; urgency=medium
 .
   * mount-v2: enter the mount namesapce to propagation properties
     (Closes: #1110096)
Checksums-Sha1:
 e03c80d31b752e9caa9921dd5f1beba12b65994f 2238 criu_3.17.1-2+deb12u2.dsc
 768d40ef37822c27e2ec90d828d5772f0f4d8b76 13716 criu_3.17.1-2+deb12u2.debian.tar.xz
Checksums-Sha256:
 9bc7473557ebeb93a1c0ef016f4906e8c4851b1efe123dea44c5313702f6ea96 2238 criu_3.17.1-2+deb12u2.dsc
 bb1a4b2cc8b2e6b4d9767cd6901045cadcbfdea2739fef471d3a77caddd78ca7 13716 criu_3.17.1-2+deb12u2.debian.tar.xz
Files:
 1da9b0f9369e29a9aa8a6b6bb82781fb 2238 admin optional criu_3.17.1-2+deb12u2.dsc
 39c6e40c01d7706d799ce9d33760f216 13716 admin optional criu_3.17.1-2+deb12u2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmirEixfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EWQUP/353LvtxKuwHHWWSbLktpb+GPGMRtwRO
dN4Z9vwLg6PJhXxTz0JHRBx+lfnl3pshAJByyDSppcn/IsgRqehD2HyI6QHLb5t8
jcSwVun2ddPx3efGmYhqAClY+0z0VlDW8N+j6jnbZwH8WPyulUgX329W8pugIHly
ctNwbmdVwRYdJLPcHG3bUVZY06ufv3PtS6z8GVxHHcC+G2oygcwu9OwDMlyOmBpH
s+5OYhVgaRFzSahoMxNKWYJhVlfRbiK1Xfy3cPyV3dqzvwWSw8bO4lZhmw6j3eXo
mQYfaA64l3C/bH03yZLPS+fphS1lm8d0Y1hYsvVepvhbZ2+EaikvIOeFi9bUlBm1
59jqfqTtB32sQtHbXGlHS3cU+RbgBCal2op1RfpMcs46Sqbz6xJO/3CjPjnVbsD8
9Z8AAWHB8wCkmjZnus8oPrcw5s7ZJh6Dak5AAz6b7PX8V/9HVnLtSOgXeKEBw6Tt
TH5VDDDXCzWiiWXkJTp9t4PvuGuP2iqYtBgnlaytDZH2+Au0yJ0hdlBgahSYFiHn
hDSKpsMRuIfaZmwNW0h0SXZqBgefVSZTYYXShr2+/2z2E7SEcSFX8vaRcnQItPCK
3fn3fQdtJ5T02Jcwp00kk/QKZpALzf/GC1SIMXXG4VKeNpEv379p4qNG1yTaCEfV
uXBM95Yoe7KH
=2c++
-----END PGP SIGNATURE-----