CVE-2025-38499 clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

High 7.8 Published 11 Aug 2025 Updated 15 Oct 2026

A missing capability check in the Linux kernel allows local attackers to escalate privileges by cloning private mounts without proper user namespace authorization.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2025-38499?

CVE-2025-38499 is a high-severity vulnerability in Debian Debian Linux, published on 11 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to.

clone_private_mnt() checks the former, but not the latter.

There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above.

Which versions are affected by CVE-2025-38499?

It affects 2 products.

Linux distribution packages (3)

`kpatch-patch-5_14_0-611_9_1` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-1.el9_7`
`kpatch-patch-5_14_0-611_9_1-debuginfo` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-1.el9_7`
`kpatch-patch-5_14_0-611_9_1-debugsource` Red Hat:enterprise_linux:9::baseos	All versions	`0:1-1.el9_7`

Products include Debian Debian Linux, Linux kernel.

How do I fix CVE-2025-38499?

Apply the vendor's patch.

Is CVE-2025-38499 being exploited?

There is no known exploitation of CVE-2025-38499 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-66174, AZL-73470, BELL-CVE-2025-38499, DEBIAN-CVE-2025-38499, GHSA-cc85-5h45-qhc8, RHSA-2025:23730 and 5 more.