CVE-2025-38058

__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock

State: Published
Severity: 7.8 High
Published: Jun 18, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock

... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput().

Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	48a066e72d970a3e225a9c18690d570c736fc455 to before 628fb00195ce21a90cf9e4e3d105cd9e58f77b40Affected 48a066e72d970a3e225a9c18690d570c736fc455 to before b89eb56a378b7b2c1176787fc228d0a57172bdd5Affected 48a066e72d970a3e225a9c18690d570c736fc455 to before f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42Affected 48a066e72d970a3e225a9c18690d570c736fc455 to before 9b0915e72b3cf52474dcee0b24a2f99d93e604a3Affected 48a066e72d970a3e225a9c18690d570c736fc455 to before d8ece4ced3b051e656c77180df2e69e19e24edc1Affected 48a066e72d970a3e225a9c18690d570c736fc455 to before 8cafd7266fa02e0863bacbf872fe635c0b9725ebAffected 48a066e72d970a3e225a9c18690d570c736fc455 to before b55996939c71a3e1a38f3cdc6a8859797efc9083Affected 48a066e72d970a3e225a9c18690d570c736fc455 to before 250cf3693060a5f803c5f1ddc082bb06b16112a9Affected
LinuxLinux	3.13Affected before 3.13Not affected 5.4.294 through 5.4.Not affected 5.10.238 through 5.10.Not affected 5.15.185 through 5.15.Not affected 6.1.141 through 6.1.Not affected 6.6.93 through 6.6.Not affected 6.12.31 through 6.12.Not affected 6.14.9 through 6.14.*Not affected 6.15 and laterNot affected

Product

Versions

LinuxLinux

48a066e72d970a3e225a9c18690d570c736fc455 to before 628fb00195ce21a90cf9e4e3d105cd9e58f77b40Affected
48a066e72d970a3e225a9c18690d570c736fc455 to before b89eb56a378b7b2c1176787fc228d0a57172bdd5Affected
48a066e72d970a3e225a9c18690d570c736fc455 to before f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42Affected
48a066e72d970a3e225a9c18690d570c736fc455 to before 9b0915e72b3cf52474dcee0b24a2f99d93e604a3Affected
48a066e72d970a3e225a9c18690d570c736fc455 to before d8ece4ced3b051e656c77180df2e69e19e24edc1Affected
48a066e72d970a3e225a9c18690d570c736fc455 to before 8cafd7266fa02e0863bacbf872fe635c0b9725ebAffected
48a066e72d970a3e225a9c18690d570c736fc455 to before b55996939c71a3e1a38f3cdc6a8859797efc9083Affected
48a066e72d970a3e225a9c18690d570c736fc455 to before 250cf3693060a5f803c5f1ddc082bb06b16112a9Affected

LinuxLinux

3.13Affected
before 3.13Not affected
5.4.294 through 5.4.*Not affected
5.10.238 through 5.10.*Not affected
5.15.185 through 5.15.*Not affected
6.1.141 through 6.1.*Not affected
6.6.93 through 6.6.*Not affected
6.12.31 through 6.12.*Not affected
6.14.9 through 6.14.*Not affected
6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.