CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
In the Linux kernel, the following vulnerability has been resolved:
legitimizemnt(): check for MNTSYNCUMOUNT should be under mountlock
... or we risk stealing final mntput from sync umount - raising mntcount after umount(2) has verified that victim is not busy, but before it has set MNTSYNCUMOUNT; in that case legitimizemnt() doesn't see that it's safe to quietly undo mntcount increment and leaves dropping the reference to caller, where it'll be a full-blown mntput().
Check under mountlock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38058?
CVE-2025-38058 has been classified with a severity that reflects its potential impact on the Linux kernel.
How do I fix CVE-2025-38058?
To fix CVE-2025-38058, update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2025-38058?
Linux systems running vulnerable versions of the Linux kernel are affected by CVE-2025-38058.
What are the potential consequences of CVE-2025-38058?
The consequences of CVE-2025-38058 may include system instability and unauthorized access or privilege escalation.
When was CVE-2025-38058 disclosed?
CVE-2025-38058 was disclosed as part of ongoing security improvements in the Linux kernel.