CVE-2025-22029

kernel: exec: fix the racy usage of fs_struct->in_exec

Published Apr 16, 2025 CVSS 3.1 · 4.7 Medium EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

No data.

No data available yet.

No solution or workaround provided in the CVE record

Source	ID	Title
EUVD	EUVD-2025-11272	In the Linux kernel, the following vulnerability has been resolved: exec: fix the racy usage of fs_struct->in_exec check_unsafe_exec() sets fs->in_exec under cred_guard_mutex, then execve() paths clear fs->in_exec lockless. This is fine if exec succeeds, but if it fails we have the following race: T1 sets fs->in_exec = 1, fails, drops cred_guard_mutex T2 sets fs->in_exec = 1 T1 clears fs->in_exec T2 continues with fs->in_exec == 0 Change fs/exec.c to clear fs->in_exec with cred_guard_mutex held.

No CVSS v4.0

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://lore.kernel.org/linux-cve-announce/2025041655-CVE-2025-22029-349f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-22029
https://www.cve.org/CVERecord?id=CVE-2025-22029

History

Type	Values Removed	Values Added
Metrics	threat_severity `Moderate`	threat_severity `None`

Type	Values Removed	Values Added
Weaknesses		CWE-362
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Type	Values Removed	Values Added
References	https://git.kernel.org/stable/c/753a620a7f8e134b444f89fe90873234e894e21a https://git.kernel.org/stable/c/a6b5070721503fb6021ebed51c925ffc66b1c5ab https://git.kernel.org/stable/c/af7bb0d2ca459f15cb5ca604dab5d9af103643f0 https://git.kernel.org/stable/c/b519f2e5800fe2391b7545ba6889df795828e885 https://git.kernel.org/stable/c/e2d8e7bd3314485e0b3b08380c659b3d1d67ed6a

Type	Values Removed	Values Added
Description	In the Linux kernel, the following vulnerability has been resolved: exec: fix the racy usage of fs_struct->in_exec check_unsafe_exec() sets fs->in_exec under cred_guard_mutex, then execve() paths clear fs->in_exec lockless. This is fine if exec succeeds, but if it fails we have the following race: T1 sets fs->in_exec = 1, fails, drops cred_guard_mutex T2 sets fs->in_exec = 1 T1 clears fs->in_exec T2 continues with fs->in_exec == 0 Change fs/exec.c to clear fs->in_exec with cred_guard_mutex held.	This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Title	exec: fix the racy usage of fs_struct->in_exec	kernel: exec: fix the racy usage of fs_struct->in_exec

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2025041655-CVE-2025-22029-349f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-22029 https://www.cve.org/CVERecord?id=CVE-2025-22029
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: exec: fix the racy usage of fs_struct->in_exec check_unsafe_exec() sets fs->in_exec under cred_guard_mutex, then execve() paths clear fs->in_exec lockless. This is fine if exec succeeds, but if it fails we have the following race: T1 sets fs->in_exec = 1, fails, drops cred_guard_mutex T2 sets fs->in_exec = 1 T1 clears fs->in_exec T2 continues with fs->in_exec == 0 Change fs/exec.c to clear fs->in_exec with cred_guard_mutex held.
Title		exec: fix the racy usage of fs_struct->in_exec
References		https://git.kernel.org/stable/c/753a620a7f8e134b444f89fe90873234e894e21a https://git.kernel.org/stable/c/a6b5070721503fb6021ebed51c925ffc66b1c5ab https://git.kernel.org/stable/c/af7bb0d2ca459f15cb5ca604dab5d9af103643f0 https://git.kernel.org/stable/c/b519f2e5800fe2391b7545ba6889df795828e885 https://git.kernel.org/stable/c/e2d8e7bd3314485e0b3b08380c659b3d1d67ed6a