CVE-2025-38411

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38411", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.013Z", "datePublished": "2025-07-25T13:20:15.835Z", "dateUpdated": "2026-08-05T12:01:40.641Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:40.641Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix double put of request\n\nIf a netfs request finishes during the pause loop, it will have the ref\nthat belongs to the IN_PROGRESS flag removed at that point - however, if it\nthen goes to the final wait loop, that will *also* put the ref because it\nsees that the IN_PROGRESS flag is clear and incorrectly assumes that this\nhappened when it called the collector.\n\nIn fact, since IN_PROGRESS is clear, we shouldn't call the collector again\nsince it's done all the cleanup, such as calling ->ki_complete().\n\nFix this by making netfs_collect_in_app() just return, indicating that\nwe're done if IN_PROGRESS is removed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The pause loop is entered only when `NETFS_RREQ_PAUSE` is set, which happens in `netfs_read_subreq_terminated()`/`netfs_write_collection()` in response to subrequest errors, short reads or retry conditions produced by the remote file server (cifs/SMB, 9p, AFS, Ceph). A malicious, compromised, or MITM'd server drives the entire trigger sequence over the network with no local access.\nAC:L - The remote server controls both halves of the sequence \u2014 it chooses which subrequest to fail (setting PAUSE) and when to complete the remaining subrequests, so it can reliably make the request finish while the app thread is in the pause loop. Nothing depends on conditions outside the attacker's influence, and the attempt can be repeated on every read/write until it lands.\nPR:N - The attacker is the network peer itself (the file server or an on-path attacker on an unsigned/unencrypted SMB/9p connection) and needs no account, credentials, or privileges on the victim client. All processing happens in the client's normal I/O path with no capability check between the received response and the double put.\nUI:N - Once a share is mounted \u2014 an ordinary pre-existing system configuration, not a per-attack action \u2014 any routine read, readahead, direct I/O or write-through by any process on the client triggers the path. No victim interaction is needed at exploitation time, consistent with the adjacent netfs collection-path CVEs.\nS:U - The corrupted object is a kernel heap allocation (`struct netfs_io_request`) and the impact stays within the kernel's own security authority. There is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The double `netfs_put_request()` drives the refcount to zero while the issuing thread still dereferences the request, reading `rreq->error`, `->transferred`, `->origin`, `->submitted` and `->len` out of freed slab memory. Because `netfs_io_request` comes from a dedicated mempool that can be re-filled by attacker-paced requests, the reclaimed contents can be groomed to leak arbitrary kernel data.\nI:H - The premature free yields a use-after-free write \u2014 a `refcount_dec` and a second `queue_work()` on `rreq->cleanup_work` inside an object that has been reallocated \u2014 which corrupts workqueue list pointers and gives a controllable write primitive suitable for control-flow hijack. The second collector pass additionally re-invokes `->ki_complete()` and `inode_dio_end()`, double-completing an AIO/io_uring request and underflowing `i_dio_count`.\nA:H - Even without grooming, the refcount underflow, double free and use-after-free reliably produce a refcount WARN, slab corruption, or kernel oops/panic, and the double `inode_dio_end()` underflow can wedge subsequent direct I/O on the inode. A hostile server can trigger it repeatedly to keep the client down."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/misc.c", "include/trace/events/netfs.h"], "versions": [{"version": "329ba1cb402ac328224965b8fc7a554a5150908e", "lessThan": "d18facba5a5795ad44b2a00a052e3db2fa77ab12", "status": "affected", "versionType": "git"}, {"version": "2b1424cd131cfaba4cf7040473133d26cddac088", "lessThan": "9df7b5ebead649b00bf9a53a798e4bf83a1318fd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/netfs/misc.c", "include/trace/events/netfs.h"], "versions": [{"version": "6.15.3", "lessThan": "6.15.6", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15.3", "versionEndExcluding": "6.15.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d18facba5a5795ad44b2a00a052e3db2fa77ab12"}, {"url": "https://git.kernel.org/stable/c/9df7b5ebead649b00bf9a53a798e4bf83a1318fd"}], "title": "netfs: Fix double put of request", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/netfs/misc.c", "include/trace/events/netfs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d18facba5a5795ad44b2a00a052e3db2fa77ab12", "status": "affected", "version": "329ba1cb402ac328224965b8fc7a554a5150908e", "versionType": "git"}, {"lessThan": "9df7b5ebead649b00bf9a53a798e4bf83a1318fd", "status": "affected", "version": "2b1424cd131cfaba4cf7040473133d26cddac088", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/netfs/misc.c", "include/trace/events/netfs.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.15.6", "status": "affected", "version": "6.15.3", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "03C8347D-D0BB-400D-85B2-E313F34D93AD", "versionEndExcluding": "6.15.6", "versionStartIncluding": "6.15.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*", "matchCriteriaId": "6D4894DB-CCFE-4602-B1BF-3960B2E19A01", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*", "matchCriteriaId": "09709862-E348-4378-8632-5A7813EDDC86", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*", "matchCriteriaId": "415BF58A-8197-43F5-B3D7-D1D63057A26E", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*", "matchCriteriaId": "A0517869-312D-4429-80C2-561086E1421C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix double put of request\n\nIf a netfs request finishes during the pause loop, it will have the ref\nthat belongs to the IN_PROGRESS flag removed at that point - however, if it\nthen goes to the final wait loop, that will *also* put the ref because it\nsees that the IN_PROGRESS flag is clear and incorrectly assumes that this\nhappened when it called the collector.\n\nIn fact, since IN_PROGRESS is clear, we shouldn't call the collector again\nsince it's done all the cleanup, such as calling ->ki_complete().\n\nFix this by making netfs_collect_in_app() just return, indicating that\nwe're done if IN_PROGRESS is removed."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfs: Corregir doble put de solicitud Si una solicitud netfs finaliza durante el bucle de pausa, tendr\u00e1 la referencia que pertenece al indicador IN_PROGRESS eliminada en ese punto; sin embargo, si luego va al bucle de espera final, eso *tambi\u00e9n* pondr\u00e1 la referencia porque ve que el indicador IN_PROGRESS est\u00e1 limpio y asume incorrectamente que esto sucedi\u00f3 cuando llam\u00f3 al recopilador. De hecho, como IN_PROGRESS est\u00e1 limpio, no deber\u00edamos volver a llamar al recopilador ya que ha hecho toda la limpieza, como llamar a ->ki_complete(). Corrija esto haciendo que netfs_collect_in_app() simplemente regrese, lo que indica que hemos terminado si se elimina IN_PROGRESS."}], "id": "CVE-2025-38411", "lastModified": "2026-07-30T06:23:12.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-07-25T14:15:32.790", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9df7b5ebead649b00bf9a53a798e4bf83a1318fd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d18facba5a5795ad44b2a00a052e3db2fa77ab12"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfs: Fix double put of request", "id": "2383424", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383424"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfs: Fix double put of request\nIf a netfs request finishes during the pause loop, it will have the ref\nthat belongs to the IN_PROGRESS flag removed at that point - however, if it\nthen goes to the final wait loop, that will *also* put the ref because it\nsees that the IN_PROGRESS flag is clear and incorrectly assumes that this\nhappened when it called the collector.\nIn fact, since IN_PROGRESS is clear, we shouldn't call the collector again\nsince it's done all the cleanup, such as calling ->ki_complete().\nFix this by making netfs_collect_in_app() just return, indicating that\nwe're done if IN_PROGRESS is removed."], "name": "CVE-2025-38411", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38411\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38411\nhttps://lore.kernel.org/linux-cve-announce/2025072521-CVE-2025-38411-0ca7@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-26T12:07:33.772687+00:00", "updated": "2025-07-26T12:07:33.772748+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}