CVE-2025-38306 (GCVE-0-2025-38306)
Vulnerability from cvelistv5
Published
2025-07-10 07:42
Modified
2026-08-05 12:01
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/fhandle.c: fix a race in call of has_locked_children() may_decode_fh() is calling has_locked_children() while holding no locks. That's an oopsable race... The rest of the callers are safe since they are holding namespace_sem and are guaranteed a positive refcount on the mount in question. Rename the current has_locked_children() to __has_locked_children(), make it static and switch the fs/namespace.c users to it. Make has_locked_children() a wrapper for __has_locked_children(), calling the latter under read_seqlock_excl(&mount_lock).
References
Impacted products
Vendor Product Version
Linux Linux Version: 620c266f394932e5decc4b34683a75dfc59dc2f4
Version: 620c266f394932e5decc4b34683a75dfc59dc2f4
Version: 620c266f394932e5decc4b34683a75dfc59dc2f4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6482c3dccbfb8d20e2856ce67c75856859930b3f",
              "status": "affected",
              "version": "620c266f394932e5decc4b34683a75dfc59dc2f4",
              "versionType": "git"
            },
            {
              "lessThan": "287c7d34eedd37af1272dfb3b6e8656f4f026424",
              "status": "affected",
              "version": "620c266f394932e5decc4b34683a75dfc59dc2f4",
              "versionType": "git"
            },
            {
              "lessThan": "1f282cdc1d219c4a557f7009e81bc792820d9d9a",
              "status": "affected",
              "version": "620c266f394932e5decc4b34683a75dfc59dc2f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/fhandle.c: fix a race in call of has_locked_children()\n\nmay_decode_fh() is calling has_locked_children() while holding no locks.\nThat\u0027s an oopsable race...\n\nThe rest of the callers are safe since they are holding namespace_sem and\nare guaranteed a positive refcount on the mount in question.\n\nRename the current has_locked_children() to __has_locked_children(), make\nit static and switch the fs/namespace.c users to it.\n\nMake has_locked_children() a wrapper for __has_locked_children(), calling\nthe latter under read_seqlock_excl(\u0026mount_lock)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through local syscalls \u2014 `open_by_handle_at(2)` drives the unlocked `has_locked_children()` traversal while `mount(2)`/`umount(2)` mutate the `mnt_mounts` list. No network or physical access is involved.\nAC:L - The attacker controls both sides of the race entirely, spinning one thread on `open_by_handle_at(..., O_DIRECTORY)` and another on bind-mount/umount in their own mount namespace; the check runs before the file handle is even copied in or validated, so the window can be hammered without needing a valid handle or any condition outside attacker control.\nPR:L - An unprivileged local user reaches the vulnerable call by running `unshare -Urm`, since the gate only needs `CAP_SYS_ADMIN` over the mount namespace\u0027s owning user namespace \u2014 which is the attacker\u0027s own newly created user namespace. It is likewise reachable by any process that is root inside an ordinary container.\nUI:N - The attacker triggers everything from their own threads; no victim action, mount, or file access by another user is required.\nS:U - The corrupted state and the resulting impact are both within the kernel\u0027s own security authority, with no crossing of a VM, hypervisor, or IOMMU boundary.\nC:H - Traversing the concurrently modified list reads freed `struct mount` memory and feeds a stale `mnt_mountpoint` into `is_subdir()`/`d_ancestor()`, chasing attacker-groomable pointers; additionally, a raced result defeats the locked-mount gate, granting `HANDLE_CHECK_SUBTREE` and letting the attacker open directory handles into subtrees deliberately hidden by locked mounts.\nI:H - The use-after-free is on `mnt_cache` objects the attacker can spray at will via `mount()`, the standard basis for heap-corruption and control-flow primitives; the same bypass also yields a writable directory fd anchor beneath mounts that locking was meant to protect.\nA:H - `list_del_init()` on a mount being unmounted leaves a self-referential entry, trapping the unsynchronized traverser in an unkillable in-kernel infinite loop (soft/hard lockup), and the freed-mount dereference produces an oops \u2014 Al Viro describes it as \"an oopsable race.\""
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:05.449Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6482c3dccbfb8d20e2856ce67c75856859930b3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/287c7d34eedd37af1272dfb3b6e8656f4f026424"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f282cdc1d219c4a557f7009e81bc792820d9d9a"
        }
      ],
      "title": "fs/fhandle.c: fix a race in call of has_locked_children()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38306",
    "datePublished": "2025-07-10T07:42:16.806Z",
    "dateReserved": "2025-04-16T04:51:24.002Z",
    "dateUpdated": "2026-08-05T12:01:05.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.