CVE-2025-38282: kernfs: Relax constraint in draining guard
In the Linux kernel, the following vulnerability has been resolved:
kernfs: Relax constraint in draining guard
The active reference lifecycle provides the break/unbreak mechanism but the active reference is not truly active after unbreak -- callers don't use it afterwards but it's important for proper pairing of kn->active counting. Assuming this mechanism is in place, the WARN check in kernfsshoulddrainopenfiles() is too sensitive -- it may transiently catch those (rightful) callers between kernfsunbreakactiveprotection() and kernfsputactive() as found out by Chen Ridong:
kernfsremovebynamens kernfsgetactive // active=1 kernfsremove // active=0x80000002 kernfsdrain ... waitevent //waiting (active == 0x80000001) kernfsbreakactiveprotection // active = 0x80000001 // continue kernfsunbreakactiveprotection // active = 0x80000002 ... kernfsshoulddrainopenfiles // warning occurs kernfsputactive
To avoid the false positives (mind paniconwarn) remove the check altogether. (This is meant as quick fix, I think active reference break/unbreak may be simplified with larger rework.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
Remove the WARN check in kernfs_should_drain_open_files() altogether to avoid false positives from callers between kernfs_unbreak_active_protection() and kernfs_put_active().
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38282?
CVE-2025-38282 has been categorized with a severity level that indicates potential risk to systems running the Linux kernel.
How do I fix CVE-2025-38282?
To remediate CVE-2025-38282, it is recommended to update your Linux kernel to the latest stable version that includes the patch.
Which versions of the Linux kernel are affected by CVE-2025-38282?
CVE-2025-38282 impacts specific versions of the Linux kernel prior to the release of the patched version.
What type of vulnerability is CVE-2025-38282?
CVE-2025-38282 is a vulnerability related to the handling of the active reference lifecycle in the Linux kernel's kernfs.
Is a workaround available for CVE-2025-38282?
Currently, no specific workarounds have been documented for CVE-2025-38282, and updating the kernel is the recommended approach.