CVE-2025-38411
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-07-25

Last updated on: 2025-11-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix double put of request If a netfs request finishes during the pause loop, it will have the ref that belongs to the IN_PROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will *also* put the ref because it sees that the IN_PROGRESS flag is clear and incorrectly assumes that this happened when it called the collector. In fact, since IN_PROGRESS is clear, we shouldn't call the collector again since it's done all the cleanup, such as calling ->ki_complete(). Fix this by making netfs_collect_in_app() just return, indicating that we're done if IN_PROGRESS is removed.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-07-25
Last Modified
2025-11-19
Generated
2026-05-07
AI Q&A
2025-07-25
EPSS Evaluated
2026-05-05
NVD
CVE-2025-38411
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel From 5.15.160 (inc) to 5.16 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-415 The product calls free() twice on the same memory address.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the Linux kernel's netfs subsystem involves a double put of a request's reference count. When a netfs request finishes during a pause loop, it removes the reference associated with the IN_PROGRESS flag. However, if the request then enters the final wait loop, it incorrectly puts the reference again because it sees the IN_PROGRESS flag as cleared and assumes cleanup has not been done. This leads to a double decrement of the reference count, which can cause improper handling of the request lifecycle. The fix ensures that if the IN_PROGRESS flag is cleared, the collector function returns immediately, preventing the double put.


How can this vulnerability impact me? :

The double put of a request's reference count can lead to memory corruption or use-after-free conditions in the kernel, potentially causing system instability, crashes, or security issues such as privilege escalation or denial of service. The exact impact depends on how the kernel handles the corrupted state resulting from this double put.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart