Unsigned code execution via Linux namespaces

Unsigned code execution in Microsoft Azure Sphere 21.01 allows local users to run arbitrary binaries through Linux namespaces. The kernel permits an unprivileged process to create user and mount namespaces, then either execute a binary from a writable tmpfs mount or use namespace-granted CAP_SYS_PTRACE to overwrite a child process's executable memory. The attacker must already execute code on an Azure Sphere device; the bypass defeats signed-code enforcement without reported confidentiality or availability impact.