CVE-2025-38058

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-38058
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38058.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-38058
Downstream
Related
Published
2025-06-18T09:33:38Z
Modified
2026-08-12T03:51:35Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
Details

In the Linux kernel, the following vulnerability has been resolved:

__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock

... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput().

Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38058.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
48a066e72d970a3e225a9c18690d570c736fc455
Fixed
628fb00195ce21a90cf9e4e3d105cd9e58f77b40
Fixed
b89eb56a378b7b2c1176787fc228d0a57172bdd5
Fixed
f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42
Fixed
9b0915e72b3cf52474dcee0b24a2f99d93e604a3
Fixed
d8ece4ced3b051e656c77180df2e69e19e24edc1
Fixed
8cafd7266fa02e0863bacbf872fe635c0b9725eb
Fixed
b55996939c71a3e1a38f3cdc6a8859797efc9083
Fixed
250cf3693060a5f803c5f1ddc082bb06b16112a9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38058.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.13.0
Fixed
5.4.294
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.238
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.185
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.141
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.93
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.31
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.14.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38058.json"