CVE-2025-38247

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

userns and mnt_idmap leak in open_tree_attr(2)

Once want_mount_setattr() has returned a positive, it does require finish_mount_kattr() to release ->mnt_userns. Failing do_mount_setattr() does not change that.

As the result, we can end up leaking userns and possibly mnt_idmap as well.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= c4a16820d90199409c9bf01c4f794e1e9e8d8fd8, < 142db4e76110dd80239f4e79810f85ea1735ad60; >= c4a16820d90199409c9bf01c4f794e1e9e8d8fd8, < 0748e553df0225754c316a92af3a77fdc057b358
LinuxLinux6.15

References

Timeline

Published
Jul 9, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-382487.8In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration TheCVE-2025-382497.1In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3CVE-2025-38254.1A vulnerability, which was classified as problematic, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. AffCVE-2025-382507.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reporteCVE-2025-382515.5In the Linux kernel, the following vulnerability has been resolved: atm: clip: prevent NULL deref in clip_push() Blamed commit missed thatCVE-2025-382525.5In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix CPER handler device confusion By inspection, cxl_cper_hanCVE-2025-382535.5In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix crash in wacom_aes_battery_handler() Commit fd2a9b29dcCVE-2025-382545.5In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add sanity checks for drm_edid_raw() When EDID is retCVE-2025-382555.5In the Linux kernel, the following vulnerability has been resolved: lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly() CVE-2025-382565.5In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: fix folio unpinning syzbot complains about an unmappingCVE-2025-382577.8In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdup_user() NumbCVE-2025-382585.5In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: free old damon_sysfs_scheme_filter->memcg_path
CVE-2025-38247: Medium severity, CVSS 5.5 | Vulnix