CVE-2025-38306: fs/fhandle.c: fix a race in call of has_locked_children()
In the Linux kernel, the following vulnerability has been resolved:
fs/fhandle.c: fix a race in call of haslockedchildren()
maydecodefh() is calling haslockedchildren() while holding no locks. That's an oopsable race...
The rest of the callers are safe since they are holding namespacesem and are guaranteed a positive refcount on the mount in question.
Rename the current haslockedchildren() to haslockedchildren(), make it static and switch the fs/namespace.c users to it.
Make haslockedchildren() a wrapper for haslockedchildren(), calling the latter under readseqlockexcl(&mountlock).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38306?
CVE-2025-38306 is classified as a high-severity vulnerability due to its potential to cause system instability.
How do I fix CVE-2025-38306?
To resolve CVE-2025-38306, update the Linux kernel to the patched version that addresses the race condition in has_locked_children().
What systems are affected by CVE-2025-38306?
CVE-2025-38306 affects the Linux kernel across various distributions that use an vulnerable version.
Can CVE-2025-38306 be exploited remotely?
CVE-2025-38306 primarily requires local access to exploit, but may lead to elevated privileges if exploited.
What causes the CVE-2025-38306 vulnerability?
CVE-2025-38306 is caused by a race condition when may_decode_fh() references has_locked_children() without holding necessary locks.