In the Linux kernel, the following vulnerability has been resolved:
_legitimizemnt(): check for MNTSYNCUMOUNT should be under mount_lock
... or we risk stealing final mntput from sync umount - raising mntcount after umount(2) has verified that victim is not busy, but before it has set MNTSYNCUMOUNT; in that case _legitimizemnt() doesn't see that it's safe to quietly undo mntcount increment and leaves dropping the reference to caller, where it'll be a full-blown mntput().
Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.
[
{
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b89eb56a378b7b2c1176787fc228d0a57172bdd5",
"id": "CVE-2025-38058-56f9096d",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b55996939c71a3e1a38f3cdc6a8859797efc9083",
"id": "CVE-2025-38058-5e03ccfe",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"file": "fs/namespace.c",
"function": "__legitimize_mnt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42",
"id": "CVE-2025-38058-6d87d1f3",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"file": "fs/namespace.c",
"function": "__legitimize_mnt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b55996939c71a3e1a38f3cdc6a8859797efc9083",
"id": "CVE-2025-38058-845b2455",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"length": 523.0,
"function_hash": "133258992224963552736439702987099169787"
},
"target": {
"file": "fs/namespace.c",
"function": "__legitimize_mnt"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b89eb56a378b7b2c1176787fc228d0a57172bdd5",
"id": "CVE-2025-38058-b8a826a1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"157725919705938601020489044696458947317",
"187466084093290886335847029256601384949",
"180632530385378833794058155563267486239",
"79652479126604653823393318096103915024",
"133127381679956301147919294072234436388",
"160556368524217360912049854465851294742",
"296201462582956499580804215883172177711",
"132332874602560134522578491361325581946",
"335850285515257832977265348879443196415"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42",
"id": "CVE-2025-38058-df31bce4",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
}
]