CVE-2025-38282

MEDIUM EPSS 5.2%
Published Jul 10, 202511mo ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jul 10, 2025 11mo ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining guard The active reference lifecycle provides the break/unbreak mechanism but the active reference is not truly active after unbreak -- callers don't use it afterwards but it's important for proper pairing of kn->active counting. Assuming this mechanism is in place, the WARN check in kernfs_should_drain_open_files() is too sensitive -- it may transiently catch those (rightful) callers between kernfs_unbreak_active_protection() and kernfs_put_active() as found out by Chen Ridong: kernfs_remove_by_name_ns kernfs_get_active // active=1 __kernfs_remove // active=0x80000002 kernfs_drain ... wait_event //waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 // continue kernfs_unbreak_active_protection // active = 0x80000002 ... kernfs_should_drain_open_files // warning occurs kernfs_put_active To avoid the false positives (mind panic_on_warn) remove the check altogether. (This is meant as quick fix, I think active reference break/unbreak may be simplified with larger rework.)

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
5.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 5

VendorProductVersionRange
linuxlinux_kernel*≥6.1  –  <6.1.142
linuxlinux_kernel*≥6.2  –  <6.6.94
linuxlinux_kernel*≥6.7  –  <6.12.34
linuxlinux_kernel*≥6.13  –  <6.15.3
debiandebian_linux11.0any

References 6

  • git.kernel.org https://git.kernel.org/stable/c/071d8e4c2a3b0999a9b822e2eb8854784a350f8a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2d6a67c2b3b87808a347dc1047b520a9dd177a4f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6bfb154f95d5f0ab7ed056f23aba8c1a94cb3927
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6c81f1c7812c61f187bed1b938f1d2e391d503ab
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/72275c888f8962b406ee9c6885c79bf68cca5a63
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
    Mailing ListThird Party Advisory

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/071d8e4c2a3b0999a9b822e2eb8854784a350f8a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/2d6a67c2b3b87808a347dc1047b520a9dd177a4f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6bfb154f95d5f0ab7ed056f23aba8c1a94cb3927
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/6c81f1c7812c61f187bed1b938f1d2e391d503ab
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/72275c888f8962b406ee9c6885c79bf68cca5a63
    Patch