CVE-2025-39717

{"id": "CVE-2025-39717", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2462651ffa76b87f9c2e4403ef6e6b89b703fb2f", "lessThan": "69dbdc711d9130136824e3830191a6afffa0a1f0", "versionType": "git"}, {"status": "affected", "version": "2462651ffa76b87f9c2e4403ef6e6b89b703fb2f", "lessThan": "9308366f062129d52e0ee3f7a019f7dd41db33df", "versionType": "git"}], "programFiles": ["fs/namespace.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.16.4", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/namespace.c"], "defaultStatus": "affected"}]}], "published": "2025-09-05T18:15:49.260", "references": [{"url": "https://git.kernel.org/stable/c/69dbdc711d9130136824e3830191a6afffa0a1f0", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9308366f062129d52e0ee3f7a019f7dd41db33df", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopen_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE\n\nAs described in commit 7a54947e727b ('Merge patch series \"fs: allow\nchanging idmappings\"'), open_tree_attr(2) was necessary in order to\nallow for a detached mount to be created and have its idmappings changed\nwithout the risk of any racing threads operating on it. For this reason,\nmount_setattr(2) still does not allow for id-mappings to be changed.\n\nHowever, there was a bug in commit 2462651ffa76 (\"fs: allow changing\nidmappings\") which allowed users to bypass this restriction by calling\nopen_tree_attr(2) *without* OPEN_TREE_CLONE.\n\ncan_idmap_mount() prevented this bug from allowing an attached\nmountpoint's id-mapping from being modified (thanks to an is_anon_ns()\ncheck), but this still allows for detached (but visible) mounts to have\ntheir be id-mapping changed. This risks the same UAF and locking issues\nas described in the merge commit, and was likely unintentional."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nopen_tree_attr: no permitir cambios de id-mapping sin OPEN_TREE_CLONE\n\nComo se describe en el commit 7a54947e727b ('Fusionar serie de parches \u201cfs: permitir cambiar idmappings\u201d'), open_tree_attr(2) era necesario para permitir que se creara un montaje desasociado y que sus idmappings fueran cambiados sin el riesgo de que ning\u00fan hilo en competencia operara sobre \u00e9l. Por esta raz\u00f3n, mount_setattr(2) todav\u00eda no permite que los id-mappings sean cambiados.\n\nSin embargo, hab\u00eda un error en el commit 2462651ffa76 ('fs: permitir cambiar idmappings') que permit\u00eda a los usuarios eludir esta restricci\u00f3n llamando a open_tree_attr(2) *sin* OPEN_TREE_CLONE.\n\ncan_idmap_mount() impidi\u00f3 que este error permitiera que el id-mapping de un punto de montaje adjunto fuera modificado (gracias a una comprobaci\u00f3n de is_anon_ns()), pero esto todav\u00eda permite que los montajes desasociados (pero visibles) tengan su id-mapping cambiado. Esto arriesga los mismos problemas de UAF y de bloqueo como se describe en el commit de fusi\u00f3n, y probablemente fue involuntario."}], "lastModified": "2026-10-19T21:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F0ABA2F-347D-450F-A06E-234E055E7302", "versionEndExcluding": "6.16.4", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}