In the Linux kernel, the following vulnerability has been resolved:
open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
As described in commit 7a54947e727b ('Merge patch series "fs: allow
changing idmappings"'), open_tree_attr(2) was necessary in order to
allow for a detached mount to be created and have its idmappings changed
without the risk of any racing threads operating on it. For this reason,
mount_setattr(2) still does not allow for id-mappings to be changed.
However, there was a bug in commit 2462651ffa76 ("fs: allow changing
idmappings") which allowed users to bypass this restriction by calling
open_tree_attr(2) *without* OPEN_TREE_CLONE.
can_idmap_mount() prevented this bug from allowing an attached
mountpoint's id-mapping from being modified (thanks to an is_anon_ns()
check), but this still allows for detached (but visible) mounts to have
their be id-mapping changed. This risks the same UAF and locking issues
as described in the merge commit, and was likely unintentional.
References
Configurations
Configuration 1 (hide)
|
History
25 Nov 2025, 17:48
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-416 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/69dbdc711d9130136824e3830191a6afffa0a1f0 - Patch | |
| References | () https://git.kernel.org/stable/c/9308366f062129d52e0ee3f7a019f7dd41db33df - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Linux linux Kernel
Linux |
Information
Published : 2025-09-05 18:15
Updated : 2025-11-25 17:48
NVD link : CVE-2025-39717
Mitre link : CVE-2025-39717
CVE.ORG link : CVE-2025-39717
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free