CVE-2025-38306: fs/fhandle.c: fix a race in call of has_locked_children()
In the Linux kernel, the following vulnerability has been resolved:
fs/fhandle.c: fix a race in call of haslockedchildren()
maydecodefh() is calling haslockedchildren() while holding no locks. That's an oopsable race...
The rest of the callers are safe since they are holding namespacesem and are guaranteed a positive refcount on the mount in question.
Rename the current haslockedchildren() to haslockedchildren(), make it static and switch the fs/namespace.c users to it.
Make haslockedchildren() a wrapper for haslockedchildren(), calling the latter under readseqlockexcl(&mountlock).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38306?
CVE-2025-38306 is classified as a high-severity vulnerability due to its potential to cause system instability.
How do I fix CVE-2025-38306?
To resolve CVE-2025-38306, update the Linux kernel to the patched version that addresses the race condition in has_locked_children().
What systems are affected by CVE-2025-38306?
CVE-2025-38306 affects the Linux kernel across various distributions that use an vulnerable version.
Can CVE-2025-38306 be exploited remotely?
CVE-2025-38306 primarily requires local access to exploit, but may lead to elevated privileges if exploited.
What causes the CVE-2025-38306 vulnerability?
CVE-2025-38306 is caused by a race condition when may_decode_fh() references has_locked_children() without holding necessary locks.