CVE-2025-40203
published 2025-11-12CVE-2025-40203: In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and make…
PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
listmount: don't call path_put() under namespace semaphore
Massage listmount() and make sure we don't call path_put() under the
namespace semaphore. If we put the last reference we're fscked.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.17.6-1 (forky) | linux 6.17.6-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= b4c2bea8ceaa50cd42a8f73667389d801a3ecf2d < 659874b7ee4976ad9ce476e07fd36bc67b3537f1 | 659874b7ee4976ad9ce476e07fd36bc67b3537f1 |
| linux | linux | >= b4c2bea8ceaa50cd42a8f73667389d801a3ecf2d < 9c80da26fda2fdcaac7f92b5908875b3108830ff | 9c80da26fda2fdcaac7f92b5908875b3108830ff |
| linux | linux | >= b4c2bea8ceaa50cd42a8f73667389d801a3ecf2d < c1f86d0ac322c7e77f6f8dbd216c65d39358ffc0 | c1f86d0ac322c7e77f6f8dbd216c65d39358ffc0 |
| linux | linux_kernel | >= 0 < 6.12.57-1 | 6.12.57-1 |
| linux | linux_kernel | >= 0 < 6.17.6-1 | 6.17.6-1 |
| linux | linux_kernel | >= 0 < 6.17.0-14.14 | 6.17.0-14.14 |
| linux | linux_kernel | >= 6.13.0 < 6.17.4 | 6.17.4 |
| linux | linux_kernel | >= 6.8.0 < 6.12.54 | 6.12.54 |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-oracle | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-azure vulnerabilities
osv·2026-02-24
linux-azure vulnerabilities
linux-azure vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers
OSV
linux-oem-6.17 vulnerabilities
osv·2026-02-17
linux-oem-6.17 vulnerabilities
linux-oem-6.17 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device driv
OSV
linux-aws, linux-oracle vulnerabilities
osv·2026-02-17
linux-aws, linux-oracle vulnerabilities
linux-aws, linux-oracle vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto de
OSV
linux-gcp vulnerabilities
osv·2026-02-12
linux-gcp vulnerabilities
linux-gcp vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
OSV
linux, linux-raspi, linux-realtime vulnerabilities
osv·2026-02-12
linux, linux-raspi, linux-realtime vulnerabilities
linux, linux-raspi, linux-realtime vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and drivers;
- CPU frequency scaling framework;
- Hardwar
GHSA
GHSA-9f95-mpr2-5ghw: In the Linux kernel, the following vulnerability has been resolved:
listmount: don't call path_put() under namespace semaphore
Massage listmount() a
ghsa_unreviewed·2025-11-13
CVE-2025-40203 GHSA-9f95-mpr2-5ghw: In the Linux kernel, the following vulnerability has been resolved:
listmount: don't call path_put() under namespace semaphore
Massage listmount() a
In the Linux kernel, the following vulnerability has been resolved:
listmount: don't call path_put() under namespace semaphore
Massage listmount() and make sure we don't call path_put() under the
namespace semaphore. If we put the last reference we're fscked.
OSV
listmount: don't call path_put() under namespace semaphore
osv·2025-11-12
CVE-2025-40203 listmount: don't call path_put() under namespace semaphore
listmount: don't call path_put() under namespace semaphore
In the Linux kernel, the following vulnerability has been resolved:
listmount: don't call path_put() under namespace semaphore
Massage listmount() and make sure we don't call path_put() under the
namespace semaphore. If we put the last reference we're fscked.
OSV
CVE-2025-40203: In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and
osv·2025-11-12
CVE-2025-40203 CVE-2025-40203: In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and
In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked.
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-02-24
CVE-2025-40175 Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framewor
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-02-17
CVE-2025-40304 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and dr
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-02-17
CVE-2025-68242 Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-02-12
CVE-2025-68242 Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-02-12
CVE-2025-40304 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- Nios II architecture;
- PA-RISC architecture;
- RISC-V architecture;
- S390 architecture;
- Sun Sparc architecture;
- x86 architecture;
- Xtensa architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Network block device driver;
- Bluetooth drivers;
- Bus devices;
- Hardware random number generator core;
- Character device driver;
- Clock framework and drivers;
- Data acquisition framework and dr
Red Hat
kernel: listmount: don't call path_put() under namespace semaphore
vendor_redhat·2025-11-12·CVSS 5.8
CVE-2025-40203 [MEDIUM] CWE-664 kernel: listmount: don't call path_put() under namespace semaphore
kernel: listmount: don't call path_put() under namespace semaphore
In the Linux kernel, the following vulnerability has been resolved:
listmount: don't call path_put() under namespace semaphore
Massage listmount() and make sure we don't call path_put() under the
namespace semaphore. If we put the last reference we're fscked.
A flaw was found in the Linux kernel’s listmount() function: the code calls path_put() while holding the namespace semaphore. Under certain conditions, this can drop the final reference to a path object inappropriately, leading to unstable behavior in mount/namespace operations.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, appli
Debian
CVE-2025-40203: linux - In the Linux kernel, the following vulnerability has been resolved: listmount: ...
vendor_debian·2025
CVE-2025-40203 [LOW] CVE-2025-40203: linux - In the Linux kernel, the following vulnerability has been resolved: listmount: ...
In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.17.6-1)
sid: resolved (fixed in 6.17.6-1)
trixie: resolved (fixed in 6.12.57-1)
No detection rules found.
No public exploits indexed.
2025-11-12
Published