CVE-2025-38411: netfs: Fix double put of request
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix double put of request
If a netfs request finishes during the pause loop, it will have the ref that belongs to the INPROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will also put the ref because it sees that the INPROGRESS flag is clear and incorrectly assumes that this happened when it called the collector.
In fact, since INPROGRESS is clear, we shouldn't call the collector again since it's done all the cleanup, such as calling ->kicomplete().
Fix this by making netfscollectinapp() just return, indicating that we're done if INPROGRESS is removed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38411?
CVE-2025-38411 has been rated as high severity due to its potential to cause stability issues in the Linux kernel.
How do I fix CVE-2025-38411?
To fix CVE-2025-38411, upgrade your Linux kernel to the latest version that includes the patch for this vulnerability.
What is the impact of CVE-2025-38411?
CVE-2025-38411 could lead to a denial of service or instability in systems running affected versions of the Linux kernel.
Is CVE-2025-38411 exploitable remotely?
CVE-2025-38411 is not specifically documented as exploitably remotely, but users should apply the fix to avoid potential risks.
When was CVE-2025-38411 first reported?
CVE-2025-38411 was first reported in 2025 as an issue in the Linux kernel related to netfs request handling.