CVE-2025-38499

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38499", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.022Z", "datePublished": "2025-08-11T16:01:08.257Z", "dateUpdated": "2026-10-15T21:52:17.524Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:26.265Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns\n\nWhat we want is to verify there is that clone won't expose something\nhidden by a mount we wouldn't be able to undo. \"Wouldn't be able to undo\"\nmay be a result of MNT_LOCKED on a child, but it may also come from\nlacking admin rights in the userns of the namespace mount belongs to.\n\nclone_private_mnt() checks the former, but not the latter.\n\nThere's a number of rather confusing CAP_SYS_ADMIN checks in various\nuserns during the mount, especially with the new mount API; they serve\ndifferent purposes and in case of clone_private_mnt() they usually,\nbut not always end up covering the missing check mentioned above."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through local filesystem syscalls (fsopen/fsconfig/fsmount or mount(2)) issued by a process on the machine. There is no remote or adjacent-network exposure of clone_private_mount().\nAC:L - The attacker deterministically controls every step \u2014 creating the user namespace, opening the fs_context, passing the fd, and issuing FSCONFIG_CMD_CREATE from the confined mount namespace \u2014 with no race, no memory-layout dependency, and no reliance on any condition outside their control.\nPR:L - An ordinary unprivileged local user suffices: unshare(CLONE_NEWUSER|CLONE_NEWNS) yields CAP_SYS_ADMIN in a child userns for the fsopen(), and setns() back into that userns as its owner lets the same uid drive fsconfig() from the restricted mount namespace where it holds no privileges at all.\nUI:N - The entire sequence is performed by the attacker's own processes; no victim action, mount operation, or file access by another user is required.\nS:U - The bypassed mount visibility and the exposed files are all managed by the same kernel security authority; no VM, hypervisor, or IOMMU boundary is crossed.\nC:H - The private clone omits all child mounts, so entire directory trees deliberately concealed by mask/over-mounts the attacker cannot unmount (container masked paths, systemd InaccessiblePaths=/ProtectHome=, sandbox hiding mounts) become readable through the overlay lower layer.\nI:H - Using the same primitive for upperdir on a read-write parent mount discards read-only child bind mounts, giving direct write, create, and delete access to trees that mount-based hardening (ReadOnlyPaths=, ProtectSystem=strict, container ro binds) was enforcing as immutable.\nA:H - That regained write access covers the exact paths the confinement was protecting, so an attacker can overwrite or delete critical configuration and system files inside a hardened service or container and render it \u2014 or the host \u2014 inoperable."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/namespace.c"], "versions": [{"version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "36fecd740de2d542d2091d65d36554ee2bcf9c65", "status": "affected", "versionType": "git"}, {"version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "d717325b5ecf2a40daca85c61923e17f32306179", "status": "affected", "versionType": "git"}, {"version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "dc6a664089f10eab0fb36b6e4f705022210191d2", "status": "affected", "versionType": "git"}, {"version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "e77078e52fbf018ab986efb3c79065ab35025607", "status": "affected", "versionType": "git"}, {"version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "38628ae06e2a37770cd794802a3f1310cf9846e3", "status": "affected", "versionType": "git"}, {"version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "c28f922c9dcee0e4876a2c095939d77fe7e15116", "status": "affected", "versionType": "git"}, {"version": "c6e8810d25295acb40a7b69ed3962ff181919571", "status": "affected", "versionType": "git"}, {"version": "e3eee87c846dc47f6d8eb6d85e7271f24122a279", "status": "affected", "versionType": "git"}, {"version": "517b875dfbf58f0c6c9e32dc90f5cf42d71a42ce", "status": "affected", "versionType": "git"}, {"version": "963d85d630dabe75a3cfde44a006fec3304d07b8", "status": "affected", "versionType": "git"}, {"version": "812f39ed5b0b7f34868736de3055c92c7c4cf459", "status": "affected", "versionType": "git"}, {"version": "6a002d48a66076524f67098132538bef17e8445e", "status": "affected", "versionType": "git"}, {"version": "41812f4b84484530057513478c6770590347dc30", "status": "affected", "versionType": "git"}, {"version": "4.4.281", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.9.280", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.14.244", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.204", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.141", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.10.59", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.13.11", "lessThan": "5.14", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/namespace.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.147", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.100", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.40", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.3", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.190"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.147"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.100"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.15.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.281"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.280"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.244"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.204"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/36fecd740de2d542d2091d65d36554ee2bcf9c65"}, {"url": "https://git.kernel.org/stable/c/d717325b5ecf2a40daca85c61923e17f32306179"}, {"url": "https://git.kernel.org/stable/c/dc6a664089f10eab0fb36b6e4f705022210191d2"}, {"url": "https://git.kernel.org/stable/c/e77078e52fbf018ab986efb3c79065ab35025607"}, {"url": "https://git.kernel.org/stable/c/38628ae06e2a37770cd794802a3f1310cf9846e3"}, {"url": "https://git.kernel.org/stable/c/c28f922c9dcee0e4876a2c095939d77fe7e15116"}], "title": "clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:39:08.627Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:07:28.904Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38499", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:50:58.387852Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:17.524Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:39:08.627Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:07:28.904Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-38499", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:50:58.387852Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:50:59.383Z"}}], "cna": {"title": "clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through local filesystem syscalls (fsopen/fsconfig/fsmount or mount(2)) issued by a process on the machine. There is no remote or adjacent-network exposure of clone_private_mount().\nAC:L - The attacker deterministically controls every step \u2014 creating the user namespace, opening the fs_context, passing the fd, and issuing FSCONFIG_CMD_CREATE from the confined mount namespace \u2014 with no race, no memory-layout dependency, and no reliance on any condition outside their control.\nPR:L - An ordinary unprivileged local user suffices: unshare(CLONE_NEWUSER|CLONE_NEWNS) yields CAP_SYS_ADMIN in a child userns for the fsopen(), and setns() back into that userns as its owner lets the same uid drive fsconfig() from the restricted mount namespace where it holds no privileges at all.\nUI:N - The entire sequence is performed by the attacker's own processes; no victim action, mount operation, or file access by another user is required.\nS:U - The bypassed mount visibility and the exposed files are all managed by the same kernel security authority; no VM, hypervisor, or IOMMU boundary is crossed.\nC:H - The private clone omits all child mounts, so entire directory trees deliberately concealed by mask/over-mounts the attacker cannot unmount (container masked paths, systemd InaccessiblePaths=/ProtectHome=, sandbox hiding mounts) become readable through the overlay lower layer.\nI:H - Using the same primitive for upperdir on a read-write parent mount discards read-only child bind mounts, giving direct write, create, and delete access to trees that mount-based hardening (ReadOnlyPaths=, ProtectSystem=strict, container ro binds) was enforcing as immutable.\nA:H - That regained write access covers the exact paths the confinement was protecting, so an attacker can overwrite or delete critical configuration and system files inside a hardened service or container and render it \u2014 or the host \u2014 inoperable."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "36fecd740de2d542d2091d65d36554ee2bcf9c65", "versionType": "git"}, {"status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "d717325b5ecf2a40daca85c61923e17f32306179", "versionType": "git"}, {"status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "dc6a664089f10eab0fb36b6e4f705022210191d2", "versionType": "git"}, {"status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "e77078e52fbf018ab986efb3c79065ab35025607", "versionType": "git"}, {"status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "38628ae06e2a37770cd794802a3f1310cf9846e3", "versionType": "git"}, {"status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "lessThan": "c28f922c9dcee0e4876a2c095939d77fe7e15116", "versionType": "git"}, {"status": "affected", "version": "c6e8810d25295acb40a7b69ed3962ff181919571", "versionType": "git"}, {"status": "affected", "version": "e3eee87c846dc47f6d8eb6d85e7271f24122a279", "versionType": "git"}, {"status": "affected", "version": "517b875dfbf58f0c6c9e32dc90f5cf42d71a42ce", "versionType": "git"}, {"status": "affected", "version": "963d85d630dabe75a3cfde44a006fec3304d07b8", "versionType": "git"}, {"status": "affected", "version": "812f39ed5b0b7f34868736de3055c92c7c4cf459", "versionType": "git"}, {"status": "affected", "version": "6a002d48a66076524f67098132538bef17e8445e", "versionType": "git"}, {"status": "affected", "version": "41812f4b84484530057513478c6770590347dc30", "versionType": "git"}, {"status": "affected", "version": "4.4.281", "lessThan": "4.5", "versionType": "semver"}, {"status": "affected", "version": "4.9.280", "lessThan": "4.10", "versionType": "semver"}, {"status": "affected", "version": "4.14.244", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.204", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.141", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "5.10.59", "lessThan": "5.11", "versionType": "semver"}, {"status": "affected", "version": "5.13.11", "lessThan": "5.14", "versionType": "semver"}], "programFiles": ["fs/namespace.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.190", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.147", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.100", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.40", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.3", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/namespace.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/36fecd740de2d542d2091d65d36554ee2bcf9c65"}, {"url": "https://git.kernel.org/stable/c/d717325b5ecf2a40daca85c61923e17f32306179"}, {"url": "https://git.kernel.org/stable/c/dc6a664089f10eab0fb36b6e4f705022210191d2"}, {"url": "https://git.kernel.org/stable/c/e77078e52fbf018ab986efb3c79065ab35025607"}, {"url": "https://git.kernel.org/stable/c/38628ae06e2a37770cd794802a3f1310cf9846e3"}, {"url": "https://git.kernel.org/stable/c/c28f922c9dcee0e4876a2c095939d77fe7e15116"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns\n\nWhat we want is to verify there is that clone won't expose something\nhidden by a mount we wouldn't be able to undo. \"Wouldn't be able to undo\"\nmay be a result of MNT_LOCKED on a child, but it may also come from\nlacking admin rights in the userns of the namespace mount belongs to.\n\nclone_private_mnt() checks the former, but not the latter.\n\nThere's a number of rather confusing CAP_SYS_ADMIN checks in various\nuserns during the mount, especially with the new mount API; they serve\ndifferent purposes and in case of clone_private_mnt() they usually,\nbut not always end up covering the missing check mentioned above."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.190", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.147", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.100", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.40", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.3", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.4.281"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.9.280"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.244"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.204"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.141"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.10.59"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.13.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:02:26.265Z"}}}, "cveMetadata": {"cveId": "CVE-2025-38499", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:17.524Z", "dateReserved": "2025-04-16T04:51:24.022Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-08-11T16:01:08.257Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/namespace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "36fecd740de2d542d2091d65d36554ee2bcf9c65", "status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "versionType": "git"}, {"lessThan": "d717325b5ecf2a40daca85c61923e17f32306179", "status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "versionType": "git"}, {"lessThan": "dc6a664089f10eab0fb36b6e4f705022210191d2", "status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "versionType": "git"}, {"lessThan": "e77078e52fbf018ab986efb3c79065ab35025607", "status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "versionType": "git"}, {"lessThan": "38628ae06e2a37770cd794802a3f1310cf9846e3", "status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "versionType": "git"}, {"lessThan": "c28f922c9dcee0e4876a2c095939d77fe7e15116", "status": "affected", "version": "427215d85e8d1476da1a86b8d67aceb485eb3631", "versionType": "git"}, {"status": "affected", "version": "c6e8810d25295acb40a7b69ed3962ff181919571", "versionType": "git"}, {"status": "affected", "version": "e3eee87c846dc47f6d8eb6d85e7271f24122a279", "versionType": "git"}, {"status": "affected", "version": "517b875dfbf58f0c6c9e32dc90f5cf42d71a42ce", "versionType": "git"}, {"status": "affected", "version": "963d85d630dabe75a3cfde44a006fec3304d07b8", "versionType": "git"}, {"status": "affected", "version": "812f39ed5b0b7f34868736de3055c92c7c4cf459", "versionType": "git"}, {"status": "affected", "version": "6a002d48a66076524f67098132538bef17e8445e", "versionType": "git"}, {"status": "affected", "version": "41812f4b84484530057513478c6770590347dc30", "versionType": "git"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.281", "versionType": "semver"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.280", "versionType": "semver"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.244", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.204", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.141", "versionType": "semver"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.59", "versionType": "semver"}, {"lessThan": "5.14", "status": "affected", "version": "5.13.11", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/namespace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.190", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.147", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.100", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.40", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5535FC0D-74B0-40D6-9F0A-6613211BD394", "versionEndExcluding": "4.5", "versionStartIncluding": "4.4.281", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DA4F8FAA-0A0A-4B05-9FD2-9B363CB18052", "versionEndExcluding": "4.10", "versionStartIncluding": "4.9.280", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0BB634A6-F36F-476C-94DA-84A3ABF7A170", "versionEndExcluding": "4.15", "versionStartIncluding": "4.14.244", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B955CF5A-B1F2-423D-B6CA-0D920E17DF1B", "versionEndExcluding": "4.20", "versionStartIncluding": "4.19.204", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1418F9CC-F473-45C3-BECA-6717DB26D246", "versionEndExcluding": "5.5", "versionStartIncluding": "5.4.141", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E50E0919-685C-4AEA-9CA2-9A611C3C1021", "versionEndExcluding": "5.11", "versionStartIncluding": "5.10.59", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "91EB0938-272F-4A6B-9615-988B8A8B0145", "versionEndExcluding": "5.14", "versionStartIncluding": "5.13.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1A202E7B-1B3B-4A22-865A-DDFC127C9289", "versionEndExcluding": "5.15.190", "versionStartIncluding": "5.14.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4FD62FC-0DAE-4ACE-8C9C-66156518C3E1", "versionEndExcluding": "6.1.147", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "094B81E0-B756-4727-85CA-F3F8D1C9D116", "versionEndExcluding": "6.6.100", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0099D5A4-B157-4D36-8858-982C7D579030", "versionEndExcluding": "6.12.40", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0541C761-BD5E-4C1A-8432-83B375D7EB92", "versionEndExcluding": "6.15.3", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*", "matchCriteriaId": "6A05198E-F8FA-4517-8D0E-8C95066AED38", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc6:*:*:*:*:*:*", "matchCriteriaId": "15013998-4AF0-4CDC-AB13-829ECD8A8E66", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.14:rc7:*:*:*:*:*:*", "matchCriteriaId": "376A25CF-C05B-48F1-99B1-8FB0314A8E06", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns\n\nWhat we want is to verify there is that clone won't expose something\nhidden by a mount we wouldn't be able to undo. \"Wouldn't be able to undo\"\nmay be a result of MNT_LOCKED on a child, but it may also come from\nlacking admin rights in the userns of the namespace mount belongs to.\n\nclone_private_mnt() checks the former, but not the latter.\n\nThere's a number of rather confusing CAP_SYS_ADMIN checks in various\nuserns during the mount, especially with the new mount API; they serve\ndifferent purposes and in case of clone_private_mnt() they usually,\nbut not always end up covering the missing check mentioned above."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clone_private_mnt(): asegurar que el llamador tenga CAP_SYS_ADMIN en los usuarios correctos. Lo que queremos es verificar que clone no exponga algo oculto por un montaje que no podamos deshacer. \"No se puede deshacer\" puede ser el resultado de MNT_LOCKED en un hijo, pero tambi\u00e9n puede provenir de la falta de derechos de administrador en los usuarios del espacio de nombres al que pertenece el montaje. clone_private_mnt() comprueba lo primero, pero no lo segundo. Hay varias comprobaciones de CAP_SYS_ADMIN bastante confusas en varios usuarios durante el montaje, especialmente con la nueva API de montaje; tienen diferentes prop\u00f3sitos y, en el caso de clone_private_mnt(), generalmente, aunque no siempre, cubren la comprobaci\u00f3n faltante mencionada anteriormente."}], "id": "CVE-2025-38499", "lastModified": "2026-10-15T22:18:43.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-38499", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:50:58.387852Z", "version": "2.0.3"}}]}, "published": "2025-08-11T16:15:30.057", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/36fecd740de2d542d2091d65d36554ee2bcf9c65"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/38628ae06e2a37770cd794802a3f1310cf9846e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c28f922c9dcee0e4876a2c095939d77fe7e15116"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d717325b5ecf2a40daca85c61923e17f32306179"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dc6a664089f10eab0fb36b6e4f705022210191d2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e77078e52fbf018ab986efb3c79065ab35025607"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns", "id": "2387670", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2387670"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-38499", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-08-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38499\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38499\nhttps://lore.kernel.org/linux-cve-announce/2025081112-CVE-2025-38499-4572@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-08-12T07:41:42.380778+00:00", "updated": "2025-08-12T07:41:42.380851+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}