CVE-2025-38396

In the Linux kernel, the following vulnerability has been resolved:

fs: export anoninodemakesecureinode() and fix secretmem LSM bypass

Export anoninodemakesecureinode() to allow KVM guestmemfd to create anonymous inodes with proper security context. This replaces the current pattern of calling allocanoninode() followed by inodeinitsecurityanon() for creating security context manually.

This change also fixes a security regression in secretmem where the SPRIVATE flag was not cleared after allocanon_inode(), causing LSM/SELinux checks to be bypassed for secretmem file descriptors.

As guestmemfd currently resides in the KVM module, we need to export this symbol for use outside the core kernel. In the future, guestmemfd might be moved to core-mm, at which point the symbols no longer would have to be exported. When/if that happens is still unclear.