CVE-2025-38247 userns and mnt_idmap leak in open_tree_attr(2)
A memory leak in the Linux kernel's open_tree_attr(2) syscall allows attackers to leak user namespace and mount ID map structures.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38247?
CVE-2025-38247 is a medium-severity vulnerability in Linux kernel, published on 9 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
userns and mnt_idmap leak in open_tree_attr(2)
Once want_mount_setattr() has returned a positive, it does require finish_mount_kattr() to release ->mnt_userns. Failing do_mount_setattr() does not change that.
As the result, we can end up leaking userns and possibly mnt_idmap as well.
Which versions are affected by CVE-2025-38247?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38247?
Apply the vendor's patch.
Is CVE-2025-38247 being exploited?
There is no known exploitation of CVE-2025-38247 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-38247, GHSA-3w4f-86g3-p6vp, UBUNTU-CVE-2025-38247.