Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2025-38499clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

Description

In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above.

Timeline

  1. ID reserved

    By Linux

  2. · 4 months later

    Published

  3. · 14 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-38499, by who scored it
Scored byCVSSScoreVector
LinuxCNA (assigner)3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified3.1Medium5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS (exploitation in 30 days)
0.20% · top 90% of all CVEs (14 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Affected products

  • Linux · Linux

    • affected 427215d85e8d1476da1a86b8d67aceb485eb3631 – < 36fecd740de2d542d2091d65d36554ee2bcf9c65
    • affected 427215d85e8d1476da1a86b8d67aceb485eb3631 – < d717325b5ecf2a40daca85c61923e17f32306179
    • affected 427215d85e8d1476da1a86b8d67aceb485eb3631 – < dc6a664089f10eab0fb36b6e4f705022210191d2
    • affected 427215d85e8d1476da1a86b8d67aceb485eb3631 – < e77078e52fbf018ab986efb3c79065ab35025607
    • affected 427215d85e8d1476da1a86b8d67aceb485eb3631 – < 38628ae06e2a37770cd794802a3f1310cf9846e3
    • affected 427215d85e8d1476da1a86b8d67aceb485eb3631 – < c28f922c9dcee0e4876a2c095939d77fe7e15116
    • affected c6e8810d25295acb40a7b69ed3962ff181919571
    • affected e3eee87c846dc47f6d8eb6d85e7271f24122a279
    • affected 517b875dfbf58f0c6c9e32dc90f5cf42d71a42ce
    • affected 963d85d630dabe75a3cfde44a006fec3304d07b8
    • affected 812f39ed5b0b7f34868736de3055c92c7c4cf459
    • affected 6a002d48a66076524f67098132538bef17e8445e
    • affected 41812f4b84484530057513478c6770590347dc30
    • affected 4.4.281 – < 4.5
    • affected 4.9.280 – < 4.10
    • affected 4.14.244 – < 4.15
    • affected 4.19.204 – < 4.20
    • affected 5.4.141 – < 5.5
    • affected 5.10.59 – < 5.11
    • affected 5.13.11 – < 5.14

  • Linux · Linux

    • affected 5.14
    • unaffected < 5.14
    • unaffected 5.15.190 – ≤ 5.15.*
    • unaffected 6.1.147 – ≤ 6.1.*
    • unaffected 6.6.100 – ≤ 6.6.*
    • unaffected 6.12.40 – ≤ 6.12.*
    • unaffected 6.15.3 – ≤ 6.15.*
    • unaffected 6.16 – ≤ *

References

References8

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-38499 badge
[![CVE-2025-38499](https://cveledger.app/badge/CVE-2025-38499.svg)](https://cveledger.app/cve/CVE-2025-38499)

Record last updated .