In the Linux kernel, the following vulnerability has been resolved:
spufs: fix gang directory lifetimes
prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have a problem with gang lifetimes - creation of a gang returns opened gang directory, which normally gets removed when that gets closed, but if somebody has created a context belonging to that gang and kept it alive until the gang got closed, removal failed and we ended up with a leak.
Unfortunately, it had been fixed the wrong way. Dentry of gang directory was no longer pinned, and rmdir on close was gone. One problem was that failure of open kept calling simple_rmdir() as cleanup, which meant an unbalanced dput(). Another bug was in the success case - gang creation incremented link count on root directory, but that was no longer undone when gang got destroyed.
Fix consists of * reverting the commit in question * adding a counter to gang, protected by ->irwsem of gang directory inode. * having it set to 1 at creation time, dropped in both spufsdirclose() and spufsgangclose() and bumped in spufscreatecontext(), provided that it's not 0. * using simplerecursive_removal() to take the gang directory out when counter reaches zero.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"139959961160336383664225014125144594673",
"239084921376144629948380899681600113779",
"116109341996871013620740550412473184616",
"51321921646418827341782263783742845234"
]
},
"id": "CVE-2025-22072-11f43593",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f280806aab28ef757aecc18df419676c10ef8",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/spufs.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 310.0,
"function_hash": "335160258708240427726072343085687890269"
},
"id": "CVE-2025-22072-1381fd32",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f280806aab28ef757aecc18df419676c10ef8",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c",
"function": "spufs_dir_close"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 310.0,
"function_hash": "335160258708240427726072343085687890269"
},
"id": "CVE-2025-22072-1886c0a2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@029d8c711f5e5fe8cf63e8a4a1a140a06e224e45",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c",
"function": "spufs_dir_close"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 294.0,
"function_hash": "275887816498445432381049178237075119570"
},
"id": "CVE-2025-22072-2cd9d77b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f280806aab28ef757aecc18df419676c10ef8",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/gang.c",
"function": "alloc_spu_gang"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"139959961160336383664225014125144594673",
"239084921376144629948380899681600113779",
"116109341996871013620740550412473184616",
"51321921646418827341782263783742845234"
]
},
"id": "CVE-2025-22072-3d47dd2e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@029d8c711f5e5fe8cf63e8a4a1a140a06e224e45",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/spufs.h"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 652.0,
"function_hash": "282777695026602327237832052455945210358"
},
"id": "CVE-2025-22072-4f29e963",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@029d8c711f5e5fe8cf63e8a4a1a140a06e224e45",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c",
"function": "spufs_mkgang"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1183.0,
"function_hash": "54433763305747452364364516280610650315"
},
"id": "CVE-2025-22072-59dc4be4",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@029d8c711f5e5fe8cf63e8a4a1a140a06e224e45",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c",
"function": "spufs_create_context"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 330.0,
"function_hash": "3834895359253080593698614850292334165"
},
"id": "CVE-2025-22072-5b97427e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@029d8c711f5e5fe8cf63e8a4a1a140a06e224e45",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c",
"function": "spufs_gang_open"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 652.0,
"function_hash": "282777695026602327237832052455945210358"
},
"id": "CVE-2025-22072-60d1b81b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f280806aab28ef757aecc18df419676c10ef8",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c",
"function": "spufs_mkgang"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1183.0,
"function_hash": "54433763305747452364364516280610650315"
},
"id": "CVE-2025-22072-6b06c20e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f280806aab28ef757aecc18df419676c10ef8",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c",
"function": "spufs_create_context"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58207589273752974492182957024335291575",
"141180018805284301379627982236078897599",
"184061394600379598345987928875795662119",
"217921655745197724159949274914283524282"
]
},
"id": "CVE-2025-22072-75d60d61",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@029d8c711f5e5fe8cf63e8a4a1a140a06e224e45",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/gang.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265079763110826146575280318061572996882",
"93820168570867212225195541356856101201",
"326596192987616013557000785817636738229",
"322515243242858452616678679621715438489",
"286605952833879820445193149329936640482",
"221983394049388527095210525537686393950",
"13190729304607721141735097429762078469",
"337272008214361546198589978610344295061",
"111486341626558770981521296057811919664",
"244301726231658045536207242341721634915",
"222940184653938680555274893883683072199",
"9185542378261972277865393825301112770",
"213028101147307882887150160880055645910",
"37814266091130857096660162549606726138",
"88965827793819215071667270797195144190",
"161394552893737791163995673807828680509",
"23657751482259440520518616256516180980",
"10308634062461573651123670202106431042",
"236728134542237170493734590277159390243",
"100532207854830931924665972196143528163",
"257185017509741750257092024016734336003",
"172628118852212700073373360680948860305",
"307246104267478782402415551630680547179",
"183837505716052907923872738143283168365",
"60474465777187070518014929005815421651",
"139294742095521630721005570671977673857",
"335611209411220624507774169307436499904",
"93865348278874054688398438836352383887",
"88974560540871297040181668209417244431",
"203221229952514337139153569542053912289",
"290456870926247611753762231416953076257",
"7502219925219907909800708495680073560",
"319203784319787056508132533676113956814",
"146258517472505696724326392315986904795",
"284758012778464730059753003633443196656",
"7868467461210107832502345050813390895",
"252541162181244082687832093669186917119",
"201146616801474854466619014839947388858",
"113957000695404369348841510220060684858",
"201541717412904143452260414197344225132"
]
},
"id": "CVE-2025-22072-89062332",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@029d8c711f5e5fe8cf63e8a4a1a140a06e224e45",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 339.0,
"function_hash": "47317110788286293348424929429994522462"
},
"id": "CVE-2025-22072-8a9c80a9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@029d8c711f5e5fe8cf63e8a4a1a140a06e224e45",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c",
"function": "spufs_create_gang"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"265079763110826146575280318061572996882",
"93820168570867212225195541356856101201",
"326596192987616013557000785817636738229",
"322515243242858452616678679621715438489",
"286605952833879820445193149329936640482",
"221983394049388527095210525537686393950",
"13190729304607721141735097429762078469",
"337272008214361546198589978610344295061",
"111486341626558770981521296057811919664",
"244301726231658045536207242341721634915",
"222940184653938680555274893883683072199",
"9185542378261972277865393825301112770",
"213028101147307882887150160880055645910",
"37814266091130857096660162549606726138",
"88965827793819215071667270797195144190",
"161394552893737791163995673807828680509",
"23657751482259440520518616256516180980",
"10308634062461573651123670202106431042",
"236728134542237170493734590277159390243",
"100532207854830931924665972196143528163",
"257185017509741750257092024016734336003",
"172628118852212700073373360680948860305",
"307246104267478782402415551630680547179",
"183837505716052907923872738143283168365",
"60474465777187070518014929005815421651",
"139294742095521630721005570671977673857",
"335611209411220624507774169307436499904",
"93865348278874054688398438836352383887",
"88974560540871297040181668209417244431",
"203221229952514337139153569542053912289",
"290456870926247611753762231416953076257",
"7502219925219907909800708495680073560",
"319203784319787056508132533676113956814",
"146258517472505696724326392315986904795",
"284758012778464730059753003633443196656",
"7868467461210107832502345050813390895",
"252541162181244082687832093669186917119",
"201146616801474854466619014839947388858",
"113957000695404369348841510220060684858",
"201541717412904143452260414197344225132"
]
},
"id": "CVE-2025-22072-8e0c8fc4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f280806aab28ef757aecc18df419676c10ef8",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 294.0,
"function_hash": "275887816498445432381049178237075119570"
},
"id": "CVE-2025-22072-8f9e03e0",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@029d8c711f5e5fe8cf63e8a4a1a140a06e224e45",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/gang.c",
"function": "alloc_spu_gang"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 339.0,
"function_hash": "47317110788286293348424929429994522462"
},
"id": "CVE-2025-22072-d88e21a1",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f280806aab28ef757aecc18df419676c10ef8",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c",
"function": "spufs_create_gang"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"58207589273752974492182957024335291575",
"141180018805284301379627982236078897599",
"184061394600379598345987928875795662119",
"217921655745197724159949274914283524282"
]
},
"id": "CVE-2025-22072-e61207cc",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f280806aab28ef757aecc18df419676c10ef8",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/gang.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 330.0,
"function_hash": "3834895359253080593698614850292334165"
},
"id": "CVE-2025-22072-ffa93f2c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@324f280806aab28ef757aecc18df419676c10ef8",
"target": {
"file": "arch/powerpc/platforms/cell/spufs/inode.c",
"function": "spufs_gang_open"
}
}
]