In the Linux kernel, the following vulnerability has been resolved:
cloneprivatemnt(): make sure that caller has CAPSYSADMIN in the right userns
What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to.
cloneprivatemnt() checks the former, but not the latter.
There's a number of rather confusing CAPSYSADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of cloneprivatemnt() they usually, but not always end up covering the missing check mentioned above.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38499.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-38499.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e77078e52fbf018ab986efb3c79065ab35025607",
"digest": {
"line_hashes": [
"101434041987137232744452494856896134294",
"200560770619317599733862542773114653079",
"283016712304528812804664476946821151182"
],
"threshold": 0.9
},
"id": "CVE-2025-38499-0d2224aa",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38628ae06e2a37770cd794802a3f1310cf9846e3",
"digest": {
"line_hashes": [
"169411682082240674043729015651820972849",
"287871853700712588688789788579577345553",
"109823976818389120034001865350177544211"
],
"threshold": 0.9
},
"id": "CVE-2025-38499-228f36f7",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc6a664089f10eab0fb36b6e4f705022210191d2",
"digest": {
"line_hashes": [
"101434041987137232744452494856896134294",
"200560770619317599733862542773114653079",
"283016712304528812804664476946821151182"
],
"threshold": 0.9
},
"id": "CVE-2025-38499-3574410c",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d717325b5ecf2a40daca85c61923e17f32306179",
"digest": {
"line_hashes": [
"101434041987137232744452494856896134294",
"200560770619317599733862542773114653079",
"283016712304528812804664476946821151182"
],
"threshold": 0.9
},
"id": "CVE-2025-38499-3fb7b43a",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38628ae06e2a37770cd794802a3f1310cf9846e3",
"digest": {
"length": 646.0,
"function_hash": "70364938062769753758425738536054594107"
},
"id": "CVE-2025-38499-5c5b682b",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c",
"function": "clone_private_mount"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dc6a664089f10eab0fb36b6e4f705022210191d2",
"digest": {
"length": 533.0,
"function_hash": "83153487980679914602537939650555580310"
},
"id": "CVE-2025-38499-7e801794",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c",
"function": "clone_private_mount"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d717325b5ecf2a40daca85c61923e17f32306179",
"digest": {
"length": 533.0,
"function_hash": "83153487980679914602537939650555580310"
},
"id": "CVE-2025-38499-afa9e939",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c",
"function": "clone_private_mount"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e77078e52fbf018ab986efb3c79065ab35025607",
"digest": {
"length": 533.0,
"function_hash": "83153487980679914602537939650555580310"
},
"id": "CVE-2025-38499-bace51ec",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c",
"function": "clone_private_mount"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28f922c9dcee0e4876a2c095939d77fe7e15116",
"digest": {
"length": 646.0,
"function_hash": "70364938062769753758425738536054594107"
},
"id": "CVE-2025-38499-deb31a8a",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c",
"function": "clone_private_mount"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36fecd740de2d542d2091d65d36554ee2bcf9c65",
"digest": {
"line_hashes": [
"101434041987137232744452494856896134294",
"200560770619317599733862542773114653079",
"283016712304528812804664476946821151182"
],
"threshold": 0.9
},
"id": "CVE-2025-38499-e3803924",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36fecd740de2d542d2091d65d36554ee2bcf9c65",
"digest": {
"length": 533.0,
"function_hash": "83153487980679914602537939650555580310"
},
"id": "CVE-2025-38499-ef51978f",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c",
"function": "clone_private_mount"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28f922c9dcee0e4876a2c095939d77fe7e15116",
"digest": {
"line_hashes": [
"169411682082240674043729015651820972849",
"287871853700712588688789788579577345553",
"109823976818389120034001865350177544211"
],
"threshold": 0.9
},
"id": "CVE-2025-38499-fca03210",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "fs/namespace.c"
}
}
]