CVE-2025-38411

A flaw was found in the Linux kernel's netfs component. A local user could exploit a double free vulnerability, where a memory reference is incorrectly released twice. This issue could lead to memory corruption, potentially allowing for privilege escalation or causing a denial of service (DoS) on the system.

A flaw of Moderate severity was found in the Linux kernel's netfs subsystem. If a netfs request finishes during the pause loop, the reference belonging to the IN_PROGRESS flag is dropped at that point; the final wait loop then incorrectly assumes it released that reference and puts it again, causing a double put (double free) of the netfs request. A local user able to trigger this code path could exploit the resulting memory corruption to cause a denial of service or potentially escalate privileges on the system. All Red Hat Enterprise Linux versions (including the kernel-rt variant) and Red Hat In-Vehicle OS are not affected by this vulnerability, because the vulnerable code is not present in the shipped kernel packages. The Red Hat severity of Moderate (CVSS 3.1 score 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) differs from the CVE.org rating of Critical (CVSS 9.8, AV:N/AC:L/PR:N), because exploitation requires local access with low privileges and high attack complexity; the issue is not remotely exploitable, contrary to what the CVE.org vector suggests.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.