CVE-2025-38058

In the Linux kernel, the following vulnerability has been resolved:

__legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock

... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput().

Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.

This vulnerability is rated as Moderate because exploitation requires local system access and precise timing to trigger a race condition during concurrent filesystem unmount and path traversal operations. An unprivileged or local user cannot trigger this remotely, and successful exploitation primarily threatens local system availability through reference count desynchronization. Red Hat Enterprise Linux systems in standard configurations remain safe from remote exposure, limiting the potential blast radius to local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.