In the Linux kernel, the following vulnerability has been resolved:
cloneprivatemnt(): make sure that caller has CAPSYSADMIN in the right userns
What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to.
cloneprivatemnt() checks the former, but not the latter.
There's a number of rather confusing CAPSYSADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of cloneprivatemnt() they usually, but not always end up covering the missing check mentioned above.
[
{
"digest": {
"line_hashes": [
"101434041987137232744452494856896134294",
"200560770619317599733862542773114653079",
"283016712304528812804664476946821151182"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"id": "CVE-2025-38499-0d2224aa",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e77078e52fbf018ab986efb3c79065ab35025607"
},
{
"digest": {
"line_hashes": [
"169411682082240674043729015651820972849",
"287871853700712588688789788579577345553",
"109823976818389120034001865350177544211"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"id": "CVE-2025-38499-228f36f7",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38628ae06e2a37770cd794802a3f1310cf9846e3"
},
{
"digest": {
"length": 646.0,
"function_hash": "70364938062769753758425738536054594107"
},
"target": {
"file": "fs/namespace.c",
"function": "clone_private_mount"
},
"signature_type": "Function",
"id": "CVE-2025-38499-5c5b682b",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38628ae06e2a37770cd794802a3f1310cf9846e3"
},
{
"digest": {
"length": 533.0,
"function_hash": "83153487980679914602537939650555580310"
},
"target": {
"file": "fs/namespace.c",
"function": "clone_private_mount"
},
"signature_type": "Function",
"id": "CVE-2025-38499-bace51ec",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e77078e52fbf018ab986efb3c79065ab35025607"
},
{
"digest": {
"length": 646.0,
"function_hash": "70364938062769753758425738536054594107"
},
"target": {
"file": "fs/namespace.c",
"function": "clone_private_mount"
},
"signature_type": "Function",
"id": "CVE-2025-38499-deb31a8a",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28f922c9dcee0e4876a2c095939d77fe7e15116"
},
{
"digest": {
"line_hashes": [
"101434041987137232744452494856896134294",
"200560770619317599733862542773114653079",
"283016712304528812804664476946821151182"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"id": "CVE-2025-38499-e3803924",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36fecd740de2d542d2091d65d36554ee2bcf9c65"
},
{
"digest": {
"length": 533.0,
"function_hash": "83153487980679914602537939650555580310"
},
"target": {
"file": "fs/namespace.c",
"function": "clone_private_mount"
},
"signature_type": "Function",
"id": "CVE-2025-38499-ef51978f",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36fecd740de2d542d2091d65d36554ee2bcf9c65"
},
{
"digest": {
"line_hashes": [
"169411682082240674043729015651820972849",
"287871853700712588688789788579577345553",
"109823976818389120034001865350177544211"
],
"threshold": 0.9
},
"target": {
"file": "fs/namespace.c"
},
"signature_type": "Line",
"id": "CVE-2025-38499-fca03210",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28f922c9dcee0e4876a2c095939d77fe7e15116"
}
]