CVE-2025-38499
In the Linux kernel, the following vulnerability has been resolved:
clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to.
clone_private_mnt() checks the former, but not the latter.
There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above.
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | 4.4.281 | 4.5 |
| linux / linux_kernel | 4.9.280 | 4.10 |
| linux / linux_kernel | 4.14.244 | 4.15 |
| linux / linux_kernel | 4.19.204 | 4.20 |
| linux / linux_kernel | 5.4.141 | 5.5 |
| linux / linux_kernel | 5.10.59 | 5.11 |
| linux / linux_kernel | 5.13.11 | 5.14 |
| linux / linux_kernel | 5.14.1 | 5.15.190 |
| linux / linux_kernel | 5.16 | 6.1.147 |
| linux / linux_kernel | 6.2 | 6.6.100 |
| linux / linux_kernel | 6.7 | 6.12.40 |
| linux / linux_kernel | 6.13 | 6.15.3 |
| linux / linux_kernel | 5.14 | 5.14.x |
| linux / linux_kernel | 5.14-rc6 | 5.14-rc6.x |
| linux / linux_kernel | 5.14-rc7 | 5.14-rc7.x |
| debian / debian_linux | 11.0 | 11.0.x |
- https://git.kernel.org/stable/c/36fecd740de2d542d2091d65d36554ee2bcf9c65
- https://git.kernel.org/stable/c/38628ae06e2a37770cd794802a3f1310cf9846e3
- https://git.kernel.org/stable/c/c28f922c9dcee0e4876a2c095939d77fe7e15116
- https://git.kernel.org/stable/c/d717325b5ecf2a40daca85c61923e17f32306179
- https://git.kernel.org/stable/c/dc6a664089f10eab0fb36b6e4f705022210191d2
- https://git.kernel.org/stable/c/e77078e52fbf018ab986efb3c79065ab35025607
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime