CVE-2025-38058 __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
A race condition in the Linux kernel's mount handling can lead to reference count errors, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38058?
CVE-2025-38058 is a high-severity vulnerability in Debian Debian Linux, published on 18 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput().
Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.
Weakness: CWE-667
Which versions are affected by CVE-2025-38058?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38058?
Apply the vendor's patch.
Is CVE-2025-38058 being exploited?
There is no known exploitation of CVE-2025-38058 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-64013, BELL-CVE-2025-38058, DEBIAN-CVE-2025-38058, GHSA-5rcm-hxrf-mw27, ROOT-OS-DEBIAN-11-CVE-2025-38058, ROOT-OS-DEBIAN-12-CVE-2025-38058 and 3 more.