Riskcovery

CVE-2025-40203

listmount: don't call path_put() under namespace semaphore

State
Published
Severity
7.8 High
Published
Nov 12, 2025
Updated
Aug 5, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

listmount: don't call path_put() under namespace semaphore

Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b4c2bea8ceaa50cd42a8f73667389d801a3ecf2d to before 659874b7ee4976ad9ce476e07fd36bc67b3537f1Affected
  • b4c2bea8ceaa50cd42a8f73667389d801a3ecf2d to before 9c80da26fda2fdcaac7f92b5908875b3108830ffAffected
  • b4c2bea8ceaa50cd42a8f73667389d801a3ecf2d to before c1f86d0ac322c7e77f6f8dbd216c65d39358ffc0Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.12.54 through 6.12.*Not affected
  • 6.17.4 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.