In the Linux kernel, the following vulnerability has been resolved:
_legitimizemnt(): check for MNTSYNCUMOUNT should be under mount_lock
... or we risk stealing final mntput from sync umount - raising mntcount after umount(2) has verified that victim is not busy, but before it has set MNTSYNCUMOUNT; in that case _legitimizemnt() doesn't see that it's safe to quietly undo mntcount increment and leaves dropping the reference to caller, where it'll be a full-blown mntput().
Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.
[
{
"id": "CVE-2025-38058-088b50fb",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@628fb00195ce21a90cf9e4e3d105cd9e58f77b40"
},
{
"id": "CVE-2025-38058-0c5c8049",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8ece4ced3b051e656c77180df2e69e19e24edc1"
},
{
"id": "CVE-2025-38058-2d7601f0",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"function": "__legitimize_mnt",
"file": "fs/namespace.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@250cf3693060a5f803c5f1ddc082bb06b16112a9"
},
{
"id": "CVE-2025-38058-3595660c",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@250cf3693060a5f803c5f1ddc082bb06b16112a9"
},
{
"id": "CVE-2025-38058-58de17ec",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b0915e72b3cf52474dcee0b24a2f99d93e604a3"
},
{
"id": "CVE-2025-38058-5e03ccfe",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b55996939c71a3e1a38f3cdc6a8859797efc9083"
},
{
"id": "CVE-2025-38058-6a887c1a",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"function": "__legitimize_mnt",
"file": "fs/namespace.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8ece4ced3b051e656c77180df2e69e19e24edc1"
},
{
"id": "CVE-2025-38058-6d87d1f3",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"function": "__legitimize_mnt",
"file": "fs/namespace.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42"
},
{
"id": "CVE-2025-38058-6ea8acf0",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"function": "__legitimize_mnt",
"file": "fs/namespace.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cafd7266fa02e0863bacbf872fe635c0b9725eb"
},
{
"id": "CVE-2025-38058-80ff91c5",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cafd7266fa02e0863bacbf872fe635c0b9725eb"
},
{
"id": "CVE-2025-38058-845b2455",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"function": "__legitimize_mnt",
"file": "fs/namespace.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b55996939c71a3e1a38f3cdc6a8859797efc9083"
},
{
"id": "CVE-2025-38058-df31bce4",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42"
},
{
"id": "CVE-2025-38058-e64e6cc7",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"function": "__legitimize_mnt",
"file": "fs/namespace.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@628fb00195ce21a90cf9e4e3d105cd9e58f77b40"
},
{
"id": "CVE-2025-38058-f12e7921",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"function": "__legitimize_mnt",
"file": "fs/namespace.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b0915e72b3cf52474dcee0b24a2f99d93e604a3"
}
]