Skip to content
Heist/ feed
High

__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput(). Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.

Announced Source revision 1
Original source ↗

CVE-2025-38058

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-38058

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "48a066e72d970a3e225a9c18690d570c736fc455",
        "lessThan": "628fb00195ce21a90cf9e4e3d105cd9e58f77b40",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "48a066e72d970a3e225a9c18690d570c736fc455",
        "lessThan": "b89eb56a378b7b2c1176787fc228d0a57172bdd5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "48a066e72d970a3e225a9c18690d570c736fc455",
        "lessThan": "f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "48a066e72d970a3e225a9c18690d570c736fc455",
        "lessThan": "9b0915e72b3cf52474dcee0b24a2f99d93e604a3",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "48a066e72d970a3e225a9c18690d570c736fc455",
        "lessThan": "d8ece4ced3b051e656c77180df2e69e19e24edc1",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "48a066e72d970a3e225a9c18690d570c736fc455",
        "lessThan": "8cafd7266fa02e0863bacbf872fe635c0b9725eb",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "48a066e72d970a3e225a9c18690d570c736fc455",
        "lessThan": "b55996939c71a3e1a38f3cdc6a8859797efc9083",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "48a066e72d970a3e225a9c18690d570c736fc455",
        "lessThan": "250cf3693060a5f803c5f1ddc082bb06b16112a9",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/namespace.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.13"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.13",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.294",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.238",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.185",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.141",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.93",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.31",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.14.9",
        "versionType": "semver",
        "lessThanOrEqual": "6.14.*"
      },
      {
        "status": "unaffected",
        "version": "6.15",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/namespace.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-38058

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30512 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement