CVE-2025-38282

kernfs: Relax constraint in draining guard

published July 10, 2025

CVSS
—
EPSS
0%
Percentile
8.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

kernfs: Relax constraint in draining guard

The active reference lifecycle provides the break/unbreak mechanism but

the active reference is not truly active after unbreak -- callers don't

use it afterwards but it's important for proper pairing of kn->active

counting. Assuming this mechanism is in place, the WARN check in

kernfs_should_drain_open_files() is too sensitive -- it may transiently

catch those (rightful) callers between

kernfs_unbreak_active_protection() and kernfs_put_active() as found out by Chen

Ridong:

kernfs_remove_by_name_ns kernfs_get_active // active=1

__kernfs_remove // active=0x80000002

kernfs_drain ...

wait_event

//waiting (active == 0x80000001)

kernfs_break_active_protection

// active = 0x80000001

// continue

kernfs_unbreak_active_protection

// active = 0x80000002

...

kernfs_should_drain_open_files

// warning occurs

kernfs_put_active

To avoid the false positives (mind panic_on_warn) remove the check altogether.

(This is meant as quick fix, I think active reference break/unbreak may be

simplified with larger rework.)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00189 · 8.1th percentile
Published
2025-07-10T07:42Z
EPSS history
Timeline
  • 10 JUL 07:42Z
    kernfs: Relax constraint in draining guard
    cvelistv5