CVE-2025-38498 (GCVE-0-2025-38498)
Vulnerability from cvelistv5
Published
2025-07-30 06:03
Modified
2025-07-30 06:03
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns permission checking with the rest of mount(2).
References
Impacted products
Vendor Product Version
Linux Linux Version: 07b20889e3052c7e77d6a6a54e7e83446eb1ba84
Version: 07b20889e3052c7e77d6a6a54e7e83446eb1ba84
Version: 07b20889e3052c7e77d6a6a54e7e83446eb1ba84
Version: 07b20889e3052c7e77d6a6a54e7e83446eb1ba84
Version: 07b20889e3052c7e77d6a6a54e7e83446eb1ba84
Version: 07b20889e3052c7e77d6a6a54e7e83446eb1ba84
Version: 07b20889e3052c7e77d6a6a54e7e83446eb1ba84
Version: 07b20889e3052c7e77d6a6a54e7e83446eb1ba84
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "787937c4e373f1722c4343e5a5a4eb0f8543e589",
              "status": "affected",
              "version": "07b20889e3052c7e77d6a6a54e7e83446eb1ba84",
              "versionType": "git"
            },
            {
              "lessThan": "c7d11fdf8e5db5f34a6c062c7e6ba3a0971879d2",
              "status": "affected",
              "version": "07b20889e3052c7e77d6a6a54e7e83446eb1ba84",
              "versionType": "git"
            },
            {
              "lessThan": "432a171d60056489270c462e651e6c3a13f855b1",
              "status": "affected",
              "version": "07b20889e3052c7e77d6a6a54e7e83446eb1ba84",
              "versionType": "git"
            },
            {
              "lessThan": "064014f7812744451d5d0592f3d2bcd727f2ee93",
              "status": "affected",
              "version": "07b20889e3052c7e77d6a6a54e7e83446eb1ba84",
              "versionType": "git"
            },
            {
              "lessThan": "4f091ad0862b02dc42a19a120b7048de848561f8",
              "status": "affected",
              "version": "07b20889e3052c7e77d6a6a54e7e83446eb1ba84",
              "versionType": "git"
            },
            {
              "lessThan": "9c1ddfeb662b668fff69c5f1cfdd9f5d23d55d23",
              "status": "affected",
              "version": "07b20889e3052c7e77d6a6a54e7e83446eb1ba84",
              "versionType": "git"
            },
            {
              "lessThan": "19554c79a2095ddde850906a067915c1ef3a4114",
              "status": "affected",
              "version": "07b20889e3052c7e77d6a6a54e7e83446eb1ba84",
              "versionType": "git"
            },
            {
              "lessThan": "12f147ddd6de7382dad54812e65f3f08d05809fc",
              "status": "affected",
              "version": "07b20889e3052c7e77d6a6a54e7e83446eb1ba84",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.15"
            },
            {
              "lessThan": "2.6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.186",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.186",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.142",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.94",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.34",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.3",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndo_change_type(): refuse to operate on unmounted/not ours mounts\n\nEnsure that propagation settings can only be changed for mounts located\nin the caller\u0027s mount namespace. This change aligns permission checking\nwith the rest of mount(2)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-30T06:03:36.483Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/787937c4e373f1722c4343e5a5a4eb0f8543e589"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7d11fdf8e5db5f34a6c062c7e6ba3a0971879d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/432a171d60056489270c462e651e6c3a13f855b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/064014f7812744451d5d0592f3d2bcd727f2ee93"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f091ad0862b02dc42a19a120b7048de848561f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c1ddfeb662b668fff69c5f1cfdd9f5d23d55d23"
        },
        {
          "url": "https://git.kernel.org/stable/c/19554c79a2095ddde850906a067915c1ef3a4114"
        },
        {
          "url": "https://git.kernel.org/stable/c/12f147ddd6de7382dad54812e65f3f08d05809fc"
        }
      ],
      "title": "do_change_type(): refuse to operate on unmounted/not ours mounts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38498",
    "datePublished": "2025-07-30T06:03:36.483Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2025-07-30T06:03:36.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38498\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-30T06:15:27.527\",\"lastModified\":\"2025-07-31T18:42:37.870\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndo_change_type(): refuse to operate on unmounted/not ours mounts\\n\\nEnsure that propagation settings can only be changed for mounts located\\nin the caller\u0027s mount namespace. This change aligns permission checking\\nwith the rest of mount(2).\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: do_change_type(): se niega a operar en montajes no montados o que no son nuestros. Garantiza que la configuraci\u00f3n de propagaci\u00f3n solo se pueda cambiar para los montajes ubicados en el espacio de nombres de montaje del invocador. Este cambio alinea la comprobaci\u00f3n de permisos con el resto de mount(2).\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/064014f7812744451d5d0592f3d2bcd727f2ee93\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/12f147ddd6de7382dad54812e65f3f08d05809fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/19554c79a2095ddde850906a067915c1ef3a4114\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/432a171d60056489270c462e651e6c3a13f855b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4f091ad0862b02dc42a19a120b7048de848561f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/787937c4e373f1722c4343e5a5a4eb0f8543e589\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9c1ddfeb662b668fff69c5f1cfdd9f5d23d55d23\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c7d11fdf8e5db5f34a6c062c7e6ba3a0971879d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.