CVE-2025-38306 (GCVE-0-2025-38306)

Vulnerability from cvelistv5 – Published: 2025-07-10 07:42 – Updated: 2026-08-05 12:01
VLAI
Title
fs/fhandle.c: fix a race in call of has_locked_children()
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/fhandle.c: fix a race in call of has_locked_children() may_decode_fh() is calling has_locked_children() while holding no locks. That's an oopsable race... The rest of the callers are safe since they are holding namespace_sem and are guaranteed a positive refcount on the mount in question. Rename the current has_locked_children() to __has_locked_children(), make it static and switch the fs/namespace.c users to it. Make has_locked_children() a wrapper for __has_locked_children(), calling the latter under read_seqlock_excl(&mount_lock).
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 620c266f394932e5decc4b34683a75dfc59dc2f4 , < 6482c3dccbfb8d20e2856ce67c75856859930b3f (git)
Affected: 620c266f394932e5decc4b34683a75dfc59dc2f4 , < 287c7d34eedd37af1272dfb3b6e8656f4f026424 (git)
Affected: 620c266f394932e5decc4b34683a75dfc59dc2f4 , < 1f282cdc1d219c4a557f7009e81bc792820d9d9a (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.46 , ≤ 6.12.* (semver)
Unaffected: 6.15.3 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6482c3dccbfb8d20e2856ce67c75856859930b3f",
              "status": "affected",
              "version": "620c266f394932e5decc4b34683a75dfc59dc2f4",
              "versionType": "git"
            },
            {
              "lessThan": "287c7d34eedd37af1272dfb3b6e8656f4f026424",
              "status": "affected",
              "version": "620c266f394932e5decc4b34683a75dfc59dc2f4",
              "versionType": "git"
            },
            {
              "lessThan": "1f282cdc1d219c4a557f7009e81bc792820d9d9a",
              "status": "affected",
              "version": "620c266f394932e5decc4b34683a75dfc59dc2f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/fhandle.c: fix a race in call of has_locked_children()\n\nmay_decode_fh() is calling has_locked_children() while holding no locks.\nThat\u0027s an oopsable race...\n\nThe rest of the callers are safe since they are holding namespace_sem and\nare guaranteed a positive refcount on the mount in question.\n\nRename the current has_locked_children() to __has_locked_children(), make\nit static and switch the fs/namespace.c users to it.\n\nMake has_locked_children() a wrapper for __has_locked_children(), calling\nthe latter under read_seqlock_excl(\u0026mount_lock)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through local syscalls \u2014 `open_by_handle_at(2)` drives the unlocked `has_locked_children()` traversal while `mount(2)`/`umount(2)` mutate the `mnt_mounts` list. No network or physical access is involved.\nAC:L - The attacker controls both sides of the race entirely, spinning one thread on `open_by_handle_at(..., O_DIRECTORY)` and another on bind-mount/umount in their own mount namespace; the check runs before the file handle is even copied in or validated, so the window can be hammered without needing a valid handle or any condition outside attacker control.\nPR:L - An unprivileged local user reaches the vulnerable call by running `unshare -Urm`, since the gate only needs `CAP_SYS_ADMIN` over the mount namespace\u0027s owning user namespace \u2014 which is the attacker\u0027s own newly created user namespace. It is likewise reachable by any process that is root inside an ordinary container.\nUI:N - The attacker triggers everything from their own threads; no victim action, mount, or file access by another user is required.\nS:U - The corrupted state and the resulting impact are both within the kernel\u0027s own security authority, with no crossing of a VM, hypervisor, or IOMMU boundary.\nC:H - Traversing the concurrently modified list reads freed `struct mount` memory and feeds a stale `mnt_mountpoint` into `is_subdir()`/`d_ancestor()`, chasing attacker-groomable pointers; additionally, a raced result defeats the locked-mount gate, granting `HANDLE_CHECK_SUBTREE` and letting the attacker open directory handles into subtrees deliberately hidden by locked mounts.\nI:H - The use-after-free is on `mnt_cache` objects the attacker can spray at will via `mount()`, the standard basis for heap-corruption and control-flow primitives; the same bypass also yields a writable directory fd anchor beneath mounts that locking was meant to protect.\nA:H - `list_del_init()` on a mount being unmounted leaves a self-referential entry, trapping the unsynchronized traverser in an unkillable in-kernel infinite loop (soft/hard lockup), and the freed-mount dereference produces an oops \u2014 Al Viro describes it as \"an oopsable race.\""
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:05.449Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6482c3dccbfb8d20e2856ce67c75856859930b3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/287c7d34eedd37af1272dfb3b6e8656f4f026424"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f282cdc1d219c4a557f7009e81bc792820d9d9a"
        }
      ],
      "title": "fs/fhandle.c: fix a race in call of has_locked_children()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38306",
    "datePublished": "2025-07-10T07:42:16.806Z",
    "dateReserved": "2025-04-16T04:51:24.002Z",
    "dateUpdated": "2026-08-05T12:01:05.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38306",
      "date": "2026-08-05",
      "epss": "0.00115",
      "percentile": "0.0183"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38306\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-10T08:15:29.440\",\"lastModified\":\"2026-07-30T06:23:06.887\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/fhandle.c: fix a race in call of has_locked_children()\\n\\nmay_decode_fh() is calling has_locked_children() while holding no locks.\\nThat\u0027s an oopsable race...\\n\\nThe rest of the callers are safe since they are holding namespace_sem and\\nare guaranteed a positive refcount on the mount in question.\\n\\nRename the current has_locked_children() to __has_locked_children(), make\\nit static and switch the fs/namespace.c users to it.\\n\\nMake has_locked_children() a wrapper for __has_locked_children(), calling\\nthe latter under read_seqlock_excl(\u0026mount_lock).\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/fhandle.c: se corrige una ejecuci\u00f3n en la llamada a has_locked_children(). may_decode_fh() llama a has_locked_children() sin bloqueos. Esta es una ejecuci\u00f3n que puede fallar. El resto de los invocadores est\u00e1n seguros, ya que mantienen namespace_sem y se les garantiza un recuento de referencias positivo en el montaje en cuesti\u00f3n. Cambie el nombre de has_locked_children() actual a __has_locked_children(), convi\u00e9rtalo en est\u00e1tico y cambie los usuarios de fs/namespace.c a \u00e9l. Convierta has_locked_children() en un contenedor para __has_locked_children(), invoc\u00e1ndolo bajo read_seqlock_excl(\u0026amp;mount_lock).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/namespace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"620c266f394932e5decc4b34683a75dfc59dc2f4\",\"lessThan\":\"6482c3dccbfb8d20e2856ce67c75856859930b3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"620c266f394932e5decc4b34683a75dfc59dc2f4\",\"lessThan\":\"287c7d34eedd37af1272dfb3b6e8656f4f026424\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"620c266f394932e5decc4b34683a75dfc59dc2f4\",\"lessThan\":\"1f282cdc1d219c4a557f7009e81bc792820d9d9a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/namespace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.46\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.3\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.12.46\",\"matchCriteriaId\":\"256E5EE4-3CDD-4BC5-B736-C8EE925C1627\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.3\",\"matchCriteriaId\":\"0541C761-BD5E-4C1A-8432-83B375D7EB92\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1f282cdc1d219c4a557f7009e81bc792820d9d9a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/287c7d34eedd37af1272dfb3b6e8656f4f026424\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6482c3dccbfb8d20e2856ce67c75856859930b3f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:14:19+00:00",
      "cve": "CVE-2025-38306",
      "id": "CVE-2025-38306",
      "initial_release_date": "2025-07-10T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Race condition leads to Denial of Service",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38306.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:10:58Z",
      "cve": "CVE-2025-38306",
      "id": "CVE-2025-38306",
      "initial_release_date": "2025-07-10T23:22:55Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "448",
      "product_status:recommended": "154",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38306",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38306.json",
      "version": "29"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.