CVE-2025-38058

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38058
In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput(). Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/250cf3693060a5f803c5f1ddc082bb06b16112a9 Patch
https://git.kernel.org/stable/c/628fb00195ce21a90cf9e4e3d105cd9e58f77b40 Patch
https://git.kernel.org/stable/c/8cafd7266fa02e0863bacbf872fe635c0b9725eb Patch
https://git.kernel.org/stable/c/9b0915e72b3cf52474dcee0b24a2f99d93e604a3 Patch
https://git.kernel.org/stable/c/b55996939c71a3e1a38f3cdc6a8859797efc9083 Patch
https://git.kernel.org/stable/c/b89eb56a378b7b2c1176787fc228d0a57172bdd5 Patch
https://git.kernel.org/stable/c/d8ece4ced3b051e656c77180df2e69e19e24edc1 Patch
https://git.kernel.org/stable/c/f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42 Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

18 Dec 2025, 21:32

Type Values Removed Values Added
CWE CWE-667
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/250cf3693060a5f803c5f1ddc082bb06b16112a9 - () https://git.kernel.org/stable/c/250cf3693060a5f803c5f1ddc082bb06b16112a9 - Patch
References () https://git.kernel.org/stable/c/628fb00195ce21a90cf9e4e3d105cd9e58f77b40 - () https://git.kernel.org/stable/c/628fb00195ce21a90cf9e4e3d105cd9e58f77b40 - Patch
References () https://git.kernel.org/stable/c/8cafd7266fa02e0863bacbf872fe635c0b9725eb - () https://git.kernel.org/stable/c/8cafd7266fa02e0863bacbf872fe635c0b9725eb - Patch
References () https://git.kernel.org/stable/c/9b0915e72b3cf52474dcee0b24a2f99d93e604a3 - () https://git.kernel.org/stable/c/9b0915e72b3cf52474dcee0b24a2f99d93e604a3 - Patch
References () https://git.kernel.org/stable/c/b55996939c71a3e1a38f3cdc6a8859797efc9083 - () https://git.kernel.org/stable/c/b55996939c71a3e1a38f3cdc6a8859797efc9083 - Patch
References () https://git.kernel.org/stable/c/b89eb56a378b7b2c1176787fc228d0a57172bdd5 - () https://git.kernel.org/stable/c/b89eb56a378b7b2c1176787fc228d0a57172bdd5 - Patch
References () https://git.kernel.org/stable/c/d8ece4ced3b051e656c77180df2e69e19e24edc1 - () https://git.kernel.org/stable/c/d8ece4ced3b051e656c77180df2e69e19e24edc1 - Patch
References () https://git.kernel.org/stable/c/f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42 - () https://git.kernel.org/stable/c/f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42 - Patch
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html - Third Party Advisory

03 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html -
  • () https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html -
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: __legitimize_mnt(): la comprobación de MNT_SYNC_UMOUNT debe estar bajo mount_lock... o corremos el riesgo de robar la mntput final de sync umount, lo que genera mnt_count después de que umount(2) haya verificado que la víctima no está ocupada, pero antes de que haya establecido MNT_SYNC_UMOUNT. En ese caso, __legitimize_mnt() no considera que sea seguro deshacer silenciosamente el incremento de mnt_count y continúa eliminando la referencia al llamador, donde se ejecutará una mntput() completa. Es necesaria la comprobación bajo mount_lock; dejar la actual activada antes de tomarla no tiene sentido; no es lo suficientemente común como para molestarse en hacerlo.

18 Jun 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 10:15

Updated : 2025-12-18 21:32

NVD link : CVE-2025-38058

Mitre link : CVE-2025-38058

CVE.ORG link : CVE-2025-38058

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-667

Improper Locking