CVE-2025-40203

CVE-2025-40203

High · published November 13, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
3.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

listmount: don't call path_put() under namespace semaphore

Massage listmount() and make sure we don't call path_put() under the

namespace semaphore. If we put the last reference we're fscked.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00151 · 3.9th percentile
Published
2025-11-13T03:15Z
References (3)
EPSS history
Timeline
  • 12 NOV 21:56Z
    listmount: don't call path_put() under namespace semaphore
    cvelistv5