cbcvebase.
CVE-2025-22072
published 2025-04-16

CVE-2025-22072: In the Linux kernel, the following vulnerability has been resolved: spufs: fix gang directory lifetimes prior to "[POWERPC] spufs: Fix gang destroy leaks" we…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
10.0th percentile
In the Linux kernel, the following vulnerability has been resolved: spufs: fix gang directory lifetimes prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have a problem with gang lifetimes - creation of a gang returns opened gang directory, which normally gets removed when that gets closed, but if somebody has created a context belonging to that gang and kept it alive until the gang got closed, removal failed and we ended up with a leak. Unfortunately, it had been fixed the wrong way. Dentry of gang directory was no longer pinned, and rmdir on close was gone. One problem was that failure of open kept calling simple_rmdir() as cleanup, which meant an unbalanced dput(). Another bug was in the success case - gang creation incremented link count on root directory, but that was no longer undone when gang got destroyed. Fix consists of * reverting the commit in question * adding a counter to gang, protected by ->i_rwsem of gang directory inode. * having it set to 1 at creation time, dropped in both spufs_dir_close() and spufs_gang_close() and bumped in spufs_create_context(), provided that it's not 0. * using simple_recursive_removal() to take the gang directory out when counter reaches zero.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.135-1 (bookworm)linux 6.1.135-1 (bookworm)
debianlinux-6.1< linux 6.1.135-1 (bookworm)linux 6.1.135-1 (bookworm)
linuxlinux
linuxlinux>= 877907d37da9694a34adc9dc3e2ce09400148cb5 < 880e7b3da2e765c1f90c94c0539be039e96c7062880e7b3da2e765c1f90c94c0539be039e96c7062
linuxlinux>= 877907d37da9694a34adc9dc3e2ce09400148cb5 < 324f280806aab28ef757aecc18df419676c10ef8324f280806aab28ef757aecc18df419676c10ef8
linuxlinux>= 877907d37da9694a34adc9dc3e2ce09400148cb5 < 029d8c711f5e5fe8cf63e8a4a1a140a06e224e45029d8c711f5e5fe8cf63e8a4a1a140a06e224e45
linuxlinux>= 877907d37da9694a34adc9dc3e2ce09400148cb5 < 903733782f3ae28a2f7fe4dfb47c7fe3e079a528903733782f3ae28a2f7fe4dfb47c7fe3e079a528
linuxlinux>= 877907d37da9694a34adc9dc3e2ce09400148cb5 < fc646a6c6d14b5d581f162a7e32999f789e3a3acfc646a6c6d14b5d581f162a7e32999f789e3a3ac
linuxlinux>= 877907d37da9694a34adc9dc3e2ce09400148cb5 < c134deabf4784e155d360744d4a6a835b9de4dd4c134deabf4784e155d360744d4a6a835b9de4dd4
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.1.135-16.1.135-1
linuxlinux_kernel>= 0 < 6.12.25-16.12.25-1
linuxlinux_kernel>= 0 < 6.12.25-16.12.25-1
linuxlinux_kernel>= 0 < 6.8.0-86.876.8.0-86.87
linuxlinux_kernel>= 0 < 6.14.0-22.226.14.0-22.22
linuxlinux_kernel>= 2.6.23 < 6.1.1346.1.134
linuxlinux_kernel>= 6.13 < 6.13.116.13.11
linuxlinux_kernel>= 6.14 < 6.14.26.14.2
linuxlinux_kernel>= 6.2 < 6.6.876.6.87
linuxlinux_kernel>= 6.7 < 6.12.236.12.23
msrcazl3_kernel_6.6.85.1-4_on_azure_linux_3.0
msrcazl3_kernel_6.6.92.2-1_on_azure_linux_3.0

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.1HIGH
vendor_ubuntu7.1HIGH
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.