CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

Q: What is the severity of CVE-2025-38499?

CVE-2025-38499 is classified as a medium severity vulnerability in the Linux kernel.

Q: How do I fix CVE-2025-38499?

To fix CVE-2025-38499, ensure that you update your Linux kernel to the latest version that includes the patch.

Q: What does CVE-2025-38499 affect?

CVE-2025-38499 affects the Linux kernel, specifically the clone_private_mnt() function related to user namespace capabilities.

Q: Who is affected by CVE-2025-38499?

Users and administrators of the Linux kernel are affected by CVE-2025-38499, especially those utilizing namespaces with modified mount points.

Q: Is CVE-2025-38499 being actively exploited?

As of now, there have been no confirmed reports of active exploitation of CVE-2025-38499.

Published Aug 11, 2025

Updated

cloneprivatemnt(): make sure that caller has CAPSYSADMIN in the right userns

Affected Software

21 affected componentsFixes available

Linux Linux kernel

Microsoft azl3 kernel 6.6.96.2-1

Microsoft azl3 kernel 6.6.96.2-2

Patch available

Microsoft cbl2 kernel 5.15.186.1-1

Patch available

Linux Linux kernel>=4.4.281<4.5

Linux Linux kernel>=4.9.280<4.10

Linux Linux kernel>=4.14.244<4.15

Linux Linux kernel>=4.19.204<4.20

Linux Linux kernel>=5.4.141<5.5

Linux Linux kernel>=5.10.59<5.11

Linux Linux kernel>=5.13.11<5.14

Linux Linux kernel>=5.14.1<5.15.190

Linux Linux kernel>=5.16<6.1.147

Linux Linux kernel>=6.2<6.6.100

Linux Linux kernel>=6.7<6.12.40

Linux Linux kernel>=6.13<6.15.3

Linux Linux kernel=5.14

Linux Linux kernel=5.14-rc6

Linux Linux kernel=5.14-rc7

Debian Debian Linux=11.0

debian/linux

6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-17.2.13-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1

Event History

Aug 11, 2025

CVE Published

via MITRE·04:01 PM

Data Sourced

via MITRE·04:01 PM

DescriptionSeverity

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityAffected Software

Data Sourced

via Red Hat·05:01 PM

DescriptionSeverityAffected Software

Sep 3, 2025

Data Sourced

via Microsoft·10:46 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4328-1

Frequently Asked Questions

What is the severity of CVE-2025-38499?

CVE-2025-38499 is classified as a medium severity vulnerability in the Linux kernel.

How do I fix CVE-2025-38499?

To fix CVE-2025-38499, ensure that you update your Linux kernel to the latest version that includes the patch.

What does CVE-2025-38499 affect?

CVE-2025-38499 affects the Linux kernel, specifically the clone_private_mnt() function related to user namespace capabilities.

Who is affected by CVE-2025-38499?

Users and administrators of the Linux kernel are affected by CVE-2025-38499, especially those utilizing namespaces with modified mount points.

Is CVE-2025-38499 being actively exploited?

As of now, there have been no confirmed reports of active exploitation of CVE-2025-38499.

CVE-2025-38499: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-38499?

How do I fix CVE-2025-38499?

What does CVE-2025-38499 affect?

Who is affected by CVE-2025-38499?

Is CVE-2025-38499 being actively exploited?

Company

Resources

Contact