CVE-2025-38282
published 2025-07-10CVE-2025-38282: In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining guard The active reference lifecycle provides the…
medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved:
kernfs: Relax constraint in draining guard
The active reference lifecycle provides the break/unbreak mechanism but
the active reference is not truly active after unbreak -- callers don't
use it afterwards but it's important for proper pairing of kn->active
counting. Assuming this mechanism is in place, the WARN check in
kernfs_should_drain_open_files() is too sensitive -- it may transiently
catch those (rightful) callers between
kernfs_unbreak_active_protection() and kernfs_put_active() as found out by Chen
Ridong:
kernfs_remove_by_name_ns kernfs_get_active // active=1
__kernfs_remove // active=0x80000002
kernfs_drain ...
wait_event
//waiting (active == 0x80000001)
kernfs_break_active_protection
// active = 0x80000001
// continue
kernfs_unbreak_active_protection
// active = 0x80000002
...
kernfs_should_drain_open_files
// warning occurs
kernfs_put_active
To avoid the false positives (mind panic_on_warn) remove the check altogether.
(This is meant as quick fix, I think active reference break/unbreak may be
simplified with larger rework.)
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 < 2d6a67c2b3b87808a347dc1047b520a9dd177a4f | 2d6a67c2b3b87808a347dc1047b520a9dd177a4f |
| linux | linux | >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 < 6c81f1c7812c61f187bed1b938f1d2e391d503ab | 6c81f1c7812c61f187bed1b938f1d2e391d503ab |
| linux | linux | >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 < 6bfb154f95d5f0ab7ed056f23aba8c1a94cb3927 | 6bfb154f95d5f0ab7ed056f23aba8c1a94cb3927 |
| linux | linux | >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 < 72275c888f8962b406ee9c6885c79bf68cca5a63 | 72275c888f8962b406ee9c6885c79bf68cca5a63 |
| linux | linux | >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 < 071d8e4c2a3b0999a9b822e2eb8854784a350f8a | 071d8e4c2a3b0999a9b822e2eb8854784a350f8a |
| linux | linux_kernel | >= 0 < 6.1.147-1 | 6.1.147-1 |
| linux | linux_kernel | >= 0 < 6.12.35-1 | 6.12.35-1 |
| linux | linux_kernel | >= 0 < 6.12.35-1 | 6.12.35-1 |
| linux | linux_kernel | >= 0 < 6.8.0-100.100 | 6.8.0-100.100 |
| linux | linux_kernel | >= 6.1 < 6.1.142 | 6.1.142 |
| linux | linux_kernel | >= 6.13 < 6.15.3 | 6.15.3 |
| linux | linux_kernel | >= 6.2 < 6.6.94 | 6.6.94 |
| linux | linux_kernel | >= 6.7 < 6.12.34 | 6.12.34 |
| msrc | azl3_kernel_6.6.92.2-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.96.1-1_on_azure_linux_3.0 | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-aws-6.8 | — | — |
| ubuntu | linux-gkeop | — | — |
| ubuntu | linux-nvidia | — | — |
| ubuntu | linux-nvidia-6.8 | — | — |
| ubuntu | linux-oracle | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM