{"id":"CVE-2025-38058","revision":"98b2bd648b6c403eb21335ef86a847b1","records":[{"revision":"98b2bd648b6c403eb21335ef86a847b1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-38058","aliases":[],"title":"__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\n__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock\n\n... or we risk stealing final mntput from sync umount - raising mnt_count\nafter umount(2) has verified that victim is not busy, but before it\nhas set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see\nthat it's safe to quietly undo mnt_count increment and leaves dropping\nthe reference to caller, where it'll be a full-blown mntput().\n\nCheck under mount_lock is needed; leaving the current one done before\ntaking that makes no sense - it's nowhere near common enough to bother\nwith.","state":0,"publishedAt":"2025-06-18T09:33:38.022+00:00","modifiedAt":"2026-10-15T21:52:06.947+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/namespace.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"48a066e72d970a3e225a9c18690d570c736fc455\",\n                            \"lessThan\": \"628fb00195ce21a90cf9e4e3d105cd9e58f77b40\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48a066e72d970a3e225a9c18690d570c736fc455\",\n                            \"lessThan\": \"b89eb56a378b7b2c1176787fc228d0a57172bdd5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48a066e72d970a3e225a9c18690d570c736fc455\",\n                            \"lessThan\": \"f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48a066e72d970a3e225a9c18690d570c736fc455\",\n                            \"lessThan\": \"9b0915e72b3cf52474dcee0b24a2f99d93e604a3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48a066e72d970a3e225a9c18690d570c736fc455\",\n                            \"lessThan\": \"d8ece4ced3b051e656c77180df2e69e19e24edc1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48a066e72d970a3e225a9c18690d570c736fc455\",\n                            \"lessThan\": \"8cafd7266fa02e0863bacbf872fe635c0b9725eb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48a066e72d970a3e225a9c18690d570c736fc455\",\n                            \"lessThan\": \"b55996939c71a3e1a38f3cdc6a8859797efc9083\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"48a066e72d970a3e225a9c18690d570c736fc455\",\n                            \"lessThan\": \"250cf3693060a5f803c5f1ddc082bb06b16112a9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/namespace.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.294\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.238\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.185\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.141\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.93\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.31\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.14.9\",\n                            \"lessThanOrEqual\": \"6.14.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.15\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/628fb00195ce21a90cf9e4e3d105cd9e58f77b40","https://git.kernel.org/stable/c/b89eb56a378b7b2c1176787fc228d0a57172bdd5","https://git.kernel.org/stable/c/f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42","https://git.kernel.org/stable/c/9b0915e72b3cf52474dcee0b24a2f99d93e604a3","https://git.kernel.org/stable/c/d8ece4ced3b051e656c77180df2e69e19e24edc1","https://git.kernel.org/stable/c/8cafd7266fa02e0863bacbf872fe635c0b9725eb","https://git.kernel.org/stable/c/b55996939c71a3e1a38f3cdc6a8859797efc9083","https://git.kernel.org/stable/c/250cf3693060a5f803c5f1ddc082bb06b16112a9"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38058","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-38058","identifiers":["CVE-2025-38058"]},"retained":false,"historicalAffected":[]}],"coverage":[]}