From 55b27a68d5918abdba557db3aa0dcf02b4b2eae9 Mon Sep 17 00:00:00 2001
From: Andrew Case <andrew@dfir.org>
Date: Fri, 31 Jan 2025 18:10:12 +0000
Subject: [PATCH] Add mnt_parent check to kernel version validation

---
 volatility3/framework/symbols/linux/extensions/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py
index 8893e6e52..232e905b8 100644
--- a/volatility3/framework/symbols/linux/extensions/__init__.py
+++ b/volatility3/framework/symbols/linux/extensions/__init__.py
@@ -1574,7 +1574,7 @@ class vfsmount(objects.StructType):
             'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3.
         """
 
-        return not self._context.symbol_space.has_type("mount")
+        return (not self._context.symbol_space.has_type("mount")) and self.has_member("mnt_parent")
 
     def is_equal(self, vfsmount_ptr) -> bool:
         """Helper to make sure it is comparing two pointers to 'vfsmount'.