CVE-2025-38499 Details
Description
In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above.
A vulnerability in the Linux kernel's handling of user namespace administrative rights has been addressed. The issue arose in the clone_private_mnt() function, which failed to verify that the caller had the necessary CAP_SYS_ADMIN capability in the appropriate user namespace. This oversight could allow a mount operation to expose hidden elements that, under normal circumstances, could not be reverted. While the function checked for locked mounts that could not be undone, it neglected to ensure that the caller had the required administrative rights in the relevant user namespace. This gap in verification could lead to unintended consequences when managing namespace mounts, particularly with the introduction of a new mount API that complicates CAP_SYS_ADMIN checks across different user namespaces.
Users can update to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched kernel can be found on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-082556.html | siemens-SADP | |
| https://git.kernel.org/stable/c/36fecd740de2d542d2091d65d36554ee2bcf9c65 | kernel.org | Patch |
| https://git.kernel.org/stable/c/38628ae06e2a37770cd794802a3f1310cf9846e3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c28f922c9dcee0e4876a2c095939d77fe7e15116 | kernel.org | Patch |
| https://git.kernel.org/stable/c/d717325b5ecf2a40daca85c61923e17f32306179 | kernel.org | Patch |
| https://git.kernel.org/stable/c/dc6a664089f10eab0fb36b6e4f705022210191d2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e77078e52fbf018ab986efb3c79065ab35025607 | kernel.org | Patch |
| https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html | CVE | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.4.281, < 4.5 >= 4.9.280, < 4.10 >= 4.14.244, < 4.15 >= 4.19.204, < 4.20 >= 5.4.141, < 5.5 >= 5.10.59, < 5.11 >= 5.13.11, < 5.14 >= 5.14.1, < 5.15.190 >= 5.16, < 6.1.147 >= 6.2, < 6.6.100 >= 6.7, < 6.12.40 >= 6.13, < 6.15.3 5.14 - 5.14 rc6 5.14 rc7 |
CPE
Remediation
| |
| debian debian linux | 11.0 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | siemens-SADP |
| May 12, 2026 | CVE Modified | siemens-SADP |
| Jan 7, 2026 | Initial Analysis | [email protected] |
| Nov 3, 2025 | CVE Modified | CVE |
| Aug 28, 2025 | CVE Modified | kernel.org |
| Aug 11, 2025 | New CVE Received | kernel.org |