CVE-2025-39717 (GCVE-0-2025-39717)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:21 – Updated: 2026-08-05 12:04
VLAI
Title
open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
Summary
In the Linux kernel, the following vulnerability has been resolved: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE As described in commit 7a54947e727b ('Merge patch series "fs: allow changing idmappings"'), open_tree_attr(2) was necessary in order to allow for a detached mount to be created and have its idmappings changed without the risk of any racing threads operating on it. For this reason, mount_setattr(2) still does not allow for id-mappings to be changed. However, there was a bug in commit 2462651ffa76 ("fs: allow changing idmappings") which allowed users to bypass this restriction by calling open_tree_attr(2) *without* OPEN_TREE_CLONE. can_idmap_mount() prevented this bug from allowing an attached mountpoint's id-mapping from being modified (thanks to an is_anon_ns() check), but this still allows for detached (but visible) mounts to have their be id-mapping changed. This risks the same UAF and locking issues as described in the merge commit, and was likely unintentional.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7056 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2462651ffa76b87f9c2e4403ef6e6b89b703fb2f , < 69dbdc711d9130136824e3830191a6afffa0a1f0 (git)
Affected: 2462651ffa76b87f9c2e4403ef6e6b89b703fb2f , < 9308366f062129d52e0ee3f7a019f7dd41db33df (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69dbdc711d9130136824e3830191a6afffa0a1f0",
              "status": "affected",
              "version": "2462651ffa76b87f9c2e4403ef6e6b89b703fb2f",
              "versionType": "git"
            },
            {
              "lessThan": "9308366f062129d52e0ee3f7a019f7dd41db33df",
              "status": "affected",
              "version": "2462651ffa76b87f9c2e4403ef6e6b89b703fb2f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopen_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE\n\nAs described in commit 7a54947e727b (\u0027Merge patch series \"fs: allow\nchanging idmappings\"\u0027), open_tree_attr(2) was necessary in order to\nallow for a detached mount to be created and have its idmappings changed\nwithout the risk of any racing threads operating on it. For this reason,\nmount_setattr(2) still does not allow for id-mappings to be changed.\n\nHowever, there was a bug in commit 2462651ffa76 (\"fs: allow changing\nidmappings\") which allowed users to bypass this restriction by calling\nopen_tree_attr(2) *without* OPEN_TREE_CLONE.\n\ncan_idmap_mount() prevented this bug from allowing an attached\nmountpoint\u0027s id-mapping from being modified (thanks to an is_anon_ns()\ncheck), but this still allows for detached (but visible) mounts to have\ntheir be id-mapping changed. This risks the same UAF and locking issues\nas described in the merge commit, and was likely unintentional."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached purely through local syscalls \u2014 `open_tree(2)` to create a detached mount and `open_tree_attr(2)` to replace its idmapping. There is no remote or adjacent-network path to fs/namespace.c mount attribute handling.\nAC:L - The attacker controls both sides of the race entirely: one thread calls `open_tree_attr()` to free the old `struct mnt_idmap` while attacker-spawned threads hammer `openat()`/`statx()`/`open_tree(OPEN_TREE_CLONE)` on the same detached-mount fd, and the replace can be repeated in a loop with a heap spray of the kmalloc-cg-192 slab.\nPR:L - Only an unprivileged local user is required \u2014 `unshare -Urm` grants CAP_SYS_ADMIN over both the new mount namespace (satisfying `may_mount()`) and over the superblock\u0027s `s_user_ns` (satisfying `can_idmap_mount()`) for a self-mounted tmpfs or fuse filesystem, both of which carry `FS_USERNS_MOUNT | FS_ALLOW_IDMAP`.\nUI:N - The attacker performs every step \u2014 creating the detached mount, applying the first idmapping, and racing the replacement \u2014 within its own processes. No victim action of any kind is needed.\nS:U - The freed object and all corrupted state live in the kernel\u0027s own memory; the impact is confined to the kernel security authority with no crossing of a VM, IOMMU, or hypervisor boundary.\nC:H - This is a use-after-free on a heap object whose contents directly determine mapped uid/gid values, so refilling the freed slot lets the attacker forge `uid_gid_map.forward` into an arbitrary kernel pointer that `bsearch()` dereferences, with the result observable via `stat()` \u2014 an arbitrary kernel memory read.\nI:H - `clone_mnt()`\u0027s `mnt_idmap_get()` performs a `refcount_inc()` on the freed object, giving a write primitive into reclaimed heap memory, and the stale/forged idmapping also causes ownership and permission decisions to be made from attacker-influenced data.\nA:H - Dereferencing the freed `struct mnt_idmap` and its `kfree()`d extent arrays, plus refcount underflow and double-free on repeated replacement, reliably produce an oops or panic taking down the whole system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:48.428Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69dbdc711d9130136824e3830191a6afffa0a1f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9308366f062129d52e0ee3f7a019f7dd41db33df"
        }
      ],
      "title": "open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39717",
    "datePublished": "2025-09-05T17:21:24.528Z",
    "dateReserved": "2025-04-16T07:20:57.117Z",
    "dateUpdated": "2026-08-05T12:04:48.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39717",
      "date": "2026-10-24",
      "epss": "0.00155",
      "percentile": "0.0429"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/namespace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "69dbdc711d9130136824e3830191a6afffa0a1f0",
                    "status": "affected",
                    "version": "2462651ffa76b87f9c2e4403ef6e6b89b703fb2f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9308366f062129d52e0ee3f7a019f7dd41db33df",
                    "status": "affected",
                    "version": "2462651ffa76b87f9c2e4403ef6e6b89b703fb2f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/namespace.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.15"
                  },
                  {
                    "lessThan": "6.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7F0ABA2F-347D-450F-A06E-234E055E7302",
                    "versionEndExcluding": "6.16.4",
                    "versionStartIncluding": "6.15",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopen_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE\n\nAs described in commit 7a54947e727b (\u0027Merge patch series \"fs: allow\nchanging idmappings\"\u0027), open_tree_attr(2) was necessary in order to\nallow for a detached mount to be created and have its idmappings changed\nwithout the risk of any racing threads operating on it. For this reason,\nmount_setattr(2) still does not allow for id-mappings to be changed.\n\nHowever, there was a bug in commit 2462651ffa76 (\"fs: allow changing\nidmappings\") which allowed users to bypass this restriction by calling\nopen_tree_attr(2) *without* OPEN_TREE_CLONE.\n\ncan_idmap_mount() prevented this bug from allowing an attached\nmountpoint\u0027s id-mapping from being modified (thanks to an is_anon_ns()\ncheck), but this still allows for detached (but visible) mounts to have\ntheir be id-mapping changed. This risks the same UAF and locking issues\nas described in the merge commit, and was likely unintentional."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nopen_tree_attr: no permitir cambios de id-mapping sin OPEN_TREE_CLONE\n\nComo se describe en el commit 7a54947e727b (\u0027Fusionar serie de parches \u201cfs: permitir cambiar idmappings\u201d\u0027), open_tree_attr(2) era necesario para permitir que se creara un montaje desasociado y que sus idmappings fueran cambiados sin el riesgo de que ning\u00fan hilo en competencia operara sobre \u00e9l. Por esta raz\u00f3n, mount_setattr(2) todav\u00eda no permite que los id-mappings sean cambiados.\n\nSin embargo, hab\u00eda un error en el commit 2462651ffa76 (\u0027fs: permitir cambiar idmappings\u0027) que permit\u00eda a los usuarios eludir esta restricci\u00f3n llamando a open_tree_attr(2) *sin* OPEN_TREE_CLONE.\n\ncan_idmap_mount() impidi\u00f3 que este error permitiera que el id-mapping de un punto de montaje adjunto fuera modificado (gracias a una comprobaci\u00f3n de is_anon_ns()), pero esto todav\u00eda permite que los montajes desasociados (pero visibles) tengan su id-mapping cambiado. Esto arriesga los mismos problemas de UAF y de bloqueo como se describe en el commit de fusi\u00f3n, y probablemente fue involuntario."
          }
        ],
        "id": "CVE-2025-39717",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-09-05T18:15:49.260",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/69dbdc711d9130136824e3830191a6afffa0a1f0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9308366f062129d52e0ee3f7a019f7dd41db33df"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:57:27+00:00",
      "cve": "CVE-2025-39717",
      "id": "CVE-2025-39717",
      "initial_release_date": "2025-09-05T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39717.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.