In the Linux kernel, the following vulnerability has been resolved:
_legitimizemnt(): check for MNTSYNCUMOUNT should be under mount_lock
... or we risk stealing final mntput from sync umount - raising mntcount after umount(2) has verified that victim is not busy, but before it has set MNTSYNCUMOUNT; in that case _legitimizemnt() doesn't see that it's safe to quietly undo mntcount increment and leaves dropping the reference to caller, where it'll be a full-blown mntput().
Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8ece4ced3b051e656c77180df2e69e19e24edc1",
"signature_version": "v1",
"id": "CVE-2025-38058-0c5c8049"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b89eb56a378b7b2c1176787fc228d0a57172bdd5",
"signature_version": "v1",
"id": "CVE-2025-38058-56f9096d"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b0915e72b3cf52474dcee0b24a2f99d93e604a3",
"signature_version": "v1",
"id": "CVE-2025-38058-58de17ec"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b55996939c71a3e1a38f3cdc6a8859797efc9083",
"signature_version": "v1",
"id": "CVE-2025-38058-5e03ccfe"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"file": "fs/namespace.c",
"function": "__legitimize_mnt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8ece4ced3b051e656c77180df2e69e19e24edc1",
"signature_version": "v1",
"id": "CVE-2025-38058-6a887c1a"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"file": "fs/namespace.c",
"function": "__legitimize_mnt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42",
"signature_version": "v1",
"id": "CVE-2025-38058-6d87d1f3"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"file": "fs/namespace.c",
"function": "__legitimize_mnt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cafd7266fa02e0863bacbf872fe635c0b9725eb",
"signature_version": "v1",
"id": "CVE-2025-38058-6ea8acf0"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8cafd7266fa02e0863bacbf872fe635c0b9725eb",
"signature_version": "v1",
"id": "CVE-2025-38058-80ff91c5"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"file": "fs/namespace.c",
"function": "__legitimize_mnt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b55996939c71a3e1a38f3cdc6a8859797efc9083",
"signature_version": "v1",
"id": "CVE-2025-38058-845b2455"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"file": "fs/namespace.c",
"function": "__legitimize_mnt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b89eb56a378b7b2c1176787fc228d0a57172bdd5",
"signature_version": "v1",
"id": "CVE-2025-38058-b8a826a1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42",
"signature_version": "v1",
"id": "CVE-2025-38058-df31bce4"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"file": "fs/namespace.c",
"function": "__legitimize_mnt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9b0915e72b3cf52474dcee0b24a2f99d93e604a3",
"signature_version": "v1",
"id": "CVE-2025-38058-f12e7921"
}
]