BaseFortify

Publication date: 2025-11-12

Last updated on: 2025-11-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-12

Last Modified

2025-11-14

Generated

2026-07-06

AI Q&A

2025-11-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-40203

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves the Linux kernel function listmount(), where calling path_put() under the namespace semaphore can cause issues if the last reference is released improperly. The fix ensures that path_put() is not called while holding the namespace semaphore to prevent potential problems.

Impact Analysis

If the last reference is released incorrectly by calling path_put() under the namespace semaphore, it can lead to system instability or crashes, potentially affecting the reliability of the Linux kernel's mount namespace handling.

Hi! I’m here to help you understand CVE-2025-40203. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70