High 7.8Published Jun 18, 2025

CVE-2025-38058__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock

Updated under an hour ago (Oct 28, 2026, 11:40 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput(). Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 48a066e72d970a3e225a9c18690d570c736fc455 before 628fb00195ce21a90cf9e4e3d105cd9e58f77b40; from 48a066e72d970a3e225a9c18690d570c736fc455 before b89eb56a378b7b2c1176787fc228d0a57172bdd5; from 48a066e72d970a3e225a9c18690d570c736fc455 before f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42; 48a066e72d970a3e225a9c18690d570c736fc455 builds before 9b0915e72b3cf52474dcee0b24a2f99d93e604a3; from 48a066e72d970a3e225a9c18690d570c736fc455 before d8ece4ced3b051e656c77180df2e69e19e24edc1; 48a066e72d970a3e225a9c18690d570c736fc455 builds before 8cafd7266fa02e0863bacbf872fe635c0b9725eb; from 48a066e72d970a3e225a9c18690d570c736fc455 before b55996939c71a3e1a38f3cdc6a8859797efc9083; from 48a066e72d970a3e225a9c18690d570c736fc455 before 250cf3693060a5f803c5f1ddc082bb06b16112a9	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
linux linux_kernel linux:linux_kernel	before 5.4.294; from 5.5 before 5.10.238; from 5.11 before 5.15.185; from 5.16 before 6.1.141; from 6.2 before 6.6.93; from 6.7 before 6.12.31; from 6.13 before 6.14.9; 6.15; and 4 more ranges	NVD
debian debian_linux debian:debian_linux	11.0	NVD

References

References

https://git.kernel.org/stable/c/628fb00195ce21a90cf9e4e3d105cd9e58f77b40	patch
https://git.kernel.org/stable/c/b89eb56a378b7b2c1176787fc228d0a57172bdd5	patch
https://git.kernel.org/stable/c/f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42	patch
https://git.kernel.org/stable/c/9b0915e72b3cf52474dcee0b24a2f99d93e604a3	patch
https://git.kernel.org/stable/c/d8ece4ced3b051e656c77180df2e69e19e24edc1	patch
https://git.kernel.org/stable/c/8cafd7266fa02e0863bacbf872fe635c0b9725eb	patch
https://git.kernel.org/stable/c/b55996939c71a3e1a38f3cdc6a8859797efc9083	patch
https://git.kernel.org/stable/c/250cf3693060a5f803c5f1ddc082bb06b16112a9	patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html	third-party-advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html	third-party-advisory
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.