CVE-2025-38411 netfs: Fix double put of request
A double put of a request in the Linux kernel netfs subsystem can lead to use-after-free, potentially causing denial of service or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38411?
CVE-2025-38411 is a critical use after free vulnerability in Linux kernel, published on 25 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix double put of request
If a netfs request finishes during the pause loop, it will have the ref that belongs to the IN_PROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will *also* put the ref because it sees that the IN_PROGRESS flag is clear and incorrectly assumes that this happened when it called the collector.
In fact, since IN_PROGRESS is clear, we shouldn't call the collector again since it's done all the cleanup, such as calling ->ki_complete().
Fix this by making netfs_collect_in_app() just return, indicating that we're done if IN_PROGRESS is removed.
Weakness: CWE-415
Which versions are affected by CVE-2025-38411?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38411?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-38411 being exploited?
There is no known exploitation of CVE-2025-38411 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as GHSA-c3c4-j5v2-q687, UBUNTU-CVE-2025-38411.