Vulnerability-Lookup

FKIE_CVE-2025-38396

Vulnerability from fkie_nvd - Published: 2025-07-25 13:15 - Updated: 2026-07-30 06:23

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon() for creating security context manually. This change also fixes a security regression in secretmem where the S_PRIVATE flag was not cleared after alloc_anon_inode(), causing LSM/SELinux checks to be bypassed for secretmem file descriptors. As guest_memfd currently resides in the KVM module, we need to export this symbol for use outside the core kernel. In the future, guest_memfd might be moved to core-mm, at which point the symbols no longer would have to be exported. When/if that happens is still unclear.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/66d29d757c968d2bee9124816da5d718eb352959	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6ca45ea48530332a4ba09595767bd26d3232743b	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cbe4134ea4bc493239786220bd69cb8a13493190	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e3eed01347721cd7a8819568161c91d538fbf229	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f94c422157f3e43dd31990567b3e5d54b3e5b32b	Patch
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	Third Party Advisory

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.16
linux	linux_kernel	6.16
linux	linux_kernel	6.16
linux	linux_kernel	6.16
debian	debian_linux	11.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/anon_inodes.c",
            "include/linux/fs.h",
            "mm/secretmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66d29d757c968d2bee9124816da5d718eb352959",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "e3eed01347721cd7a8819568161c91d538fbf229",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "f94c422157f3e43dd31990567b3e5d54b3e5b32b",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "6ca45ea48530332a4ba09595767bd26d3232743b",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "cbe4134ea4bc493239786220bd69cb8a13493190",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/anon_inodes.c",
            "include/linux/fs.h",
            "mm/secretmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F0340C7-B3B7-4007-B73C-E0A1C597D4EA",
              "versionEndExcluding": "6.1.146",
              "versionStartIncluding": "6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB1BB991-B903-4718-966C-07C803CBEABC",
              "versionEndExcluding": "6.6.97",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B4159AA-C70D-4DE5-9EE2-8F2728F13C5D",
              "versionEndExcluding": "6.12.37",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E0BB4E0-44BC-4645-83A8-6EA232CE624C",
              "versionEndExcluding": "6.15.6",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass\n\nExport anon_inode_make_secure_inode() to allow KVM guest_memfd to create\nanonymous inodes with proper security context. This replaces the current\npattern of calling alloc_anon_inode() followed by\ninode_init_security_anon() for creating security context manually.\n\nThis change also fixes a security regression in secretmem where the\nS_PRIVATE flag was not cleared after alloc_anon_inode(), causing\nLSM/SELinux checks to be bypassed for secretmem file descriptors.\n\nAs guest_memfd currently resides in the KVM module, we need to export this\nsymbol for use outside the core kernel. In the future, guest_memfd might be\nmoved to core-mm, at which point the symbols no longer would have to be\nexported. When/if that happens is still unclear."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs: exportar anon_inode_make_secure_inode() y corregir la omisi\u00f3n de LSM de secretmem Exportar anon_inode_make_secure_inode() para permitir que KVM guest_memfd cree inodos an\u00f3nimos con el contexto de seguridad adecuado. Esto reemplaza el patr\u00f3n actual de llamar a alloc_anon_inode() seguido de inode_init_security_anon() para crear el contexto de seguridad manualmente. Este cambio tambi\u00e9n corrige una regresi\u00f3n de seguridad en secretmem donde el indicador S_PRIVATE no se borr\u00f3 despu\u00e9s de alloc_anon_inode(), lo que provoc\u00f3 que se omitieran las comprobaciones de LSM/SELinux para los descriptores de archivos de secretmem. Como guest_memfd reside actualmente en el m\u00f3dulo KVM, necesitamos exportar este s\u00edmbolo para su uso fuera del n\u00facleo del kernel. En el futuro, guest_memfd podr\u00eda moverse a core-mm, en cuyo punto los s\u00edmbolos ya no tendr\u00edan que exportarse. Cu\u00e1ndo/si eso sucede a\u00fan no est\u00e1 claro."
    }
  ],
  "id": "CVE-2025-38396",
  "lastModified": "2026-07-30T06:23:11.987",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-07-25T13:15:29.077",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/66d29d757c968d2bee9124816da5d718eb352959"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/6ca45ea48530332a4ba09595767bd26d3232743b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/cbe4134ea4bc493239786220bd69cb8a13493190"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e3eed01347721cd7a8819568161c91d538fbf229"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f94c422157f3e43dd31990567b3e5d54b3e5b32b"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2025-38396 (GCVE-0-2025-38396)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-08-05 12:01

Title

fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/66d29d757c968d2be…
https://git.kernel.org/stable/c/e3eed01347721cd7a…
https://git.kernel.org/stable/c/f94c422157f3e43dd…
https://git.kernel.org/stable/c/6ca45ea48530332a4…
https://git.kernel.org/stable/c/cbe4134ea4bc49323…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < 66d29d757c968d2bee9124816da5d718eb352959 (git) Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < e3eed01347721cd7a8819568161c91d538fbf229 (git) Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < f94c422157f3e43dd31990567b3e5d54b3e5b32b (git) Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < 6ca45ea48530332a4ba09595767bd26d3232743b (git) Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < cbe4134ea4bc493239786220bd69cb8a13493190 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.146 , ≤ 6.1.* (semver) Unaffected: 6.6.97 , ≤ 6.6.* (semver) Unaffected: 6.12.37 , ≤ 6.12.* (semver) Unaffected: 6.15.6 , ≤ 6.15.* (semver) Unaffected: 6.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:29.745Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/anon_inodes.c",
            "include/linux/fs.h",
            "mm/secretmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66d29d757c968d2bee9124816da5d718eb352959",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "e3eed01347721cd7a8819568161c91d538fbf229",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "f94c422157f3e43dd31990567b3e5d54b3e5b32b",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "6ca45ea48530332a4ba09595767bd26d3232743b",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "cbe4134ea4bc493239786220bd69cb8a13493190",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/anon_inodes.c",
            "include/linux/fs.h",
            "mm/secretmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass\n\nExport anon_inode_make_secure_inode() to allow KVM guest_memfd to create\nanonymous inodes with proper security context. This replaces the current\npattern of calling alloc_anon_inode() followed by\ninode_init_security_anon() for creating security context manually.\n\nThis change also fixes a security regression in secretmem where the\nS_PRIVATE flag was not cleared after alloc_anon_inode(), causing\nLSM/SELinux checks to be bypassed for secretmem file descriptors.\n\nAs guest_memfd currently resides in the KVM module, we need to export this\nsymbol for use outside the core kernel. In the future, guest_memfd might be\nmoved to core-mm, at which point the symbols no longer would have to be\nexported. When/if that happens is still unclear."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable object is created and operated on through local syscalls \u2014 `memfd_secret(2)`, `mmap()`, and `ftruncate()` on the resulting file descriptor. No network or adjacent-network path exists.\nAC:L - Every secretmem inode is unconditionally created with S_PRIVATE set \u2014 there is no race, no memory-layout dependency, and no timing element; the attacker simply calls memfd_secret() or receives such an fd. CONFIG_SECRETMEM defaults to y and secretmem_enable defaults to 1 since 6.6, so the affected path is present in stock distro kernels.\nPR:L - memfd_secret(2) performs no capability or permission check whatsoever, so any unprivileged local user \u2014 including one confined inside a container or user namespace \u2014 can create and operate on secretmem fds. Local account access is still required, so this is not PR:N.\nUI:N - The attacker triggers the entire sequence from their own process; no victim action, mount, or file open is needed.\nS:U - The missing enforcement affects kernel-managed objects under the kernel\u0027s own security authority; no VM, IOMMU, or hypervisor boundary is crossed. Per standard kernel scoring, MAC-policy enforcement failures remain Unchanged.\nC:H - With S_PRIVATE set, SELinux inode_has_perm() and Smack\u0027s checks return 0, so FILE__READ/FILE__MAP on a secretmem object are never evaluated \u2014 a confined domain that receives such an fd can mmap and read its contents despite policy denying it. secretmem is by design the store for the system\u0027s most sensitive data (crypto keys), and the accesses generate no AVC audit records.\nI:H - The same bypass permits PROT_WRITE shared mappings, and security_inode_setattr() is skipped entirely, so ftruncate/chown/chmod on a policy-protected secretmem object go unmediated. An attacker can overwrite or re-own another security domain\u0027s key material that the MAC policy was configured to protect.\nA:H - Because setattr and write-mapping are both unmediated, an attacker can truncate and overwrite the secretmem object a victim service depends on, destroying its key material and causing that service to fail; the unreclaimable, unmovable nature of secretmem pages compounds the effect."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:34.204Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66d29d757c968d2bee9124816da5d718eb352959"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3eed01347721cd7a8819568161c91d538fbf229"
        },
        {
          "url": "https://git.kernel.org/stable/c/f94c422157f3e43dd31990567b3e5d54b3e5b32b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ca45ea48530332a4ba09595767bd26d3232743b"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbe4134ea4bc493239786220bd69cb8a13493190"
        }
      ],
      "title": "fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38396",
    "datePublished": "2025-07-25T12:53:40.761Z",
    "dateReserved": "2025-04-16T04:51:24.011Z",
    "dateUpdated": "2026-08-05T12:01:34.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2025-38396

CVE-2025-38396 (GCVE-0-2025-38396)

Tags

Sightings

Nomenclature

Related by attack behaviour