CVE-2025-39717
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE As described in commit 7a54947e727b ('Merge patch series "fs: allow changing idmappings"'), open_tree_attr(2) was necessary in order to allow for a detached mount to be created and have its idmappings changed without the risk of any racing threads operating on it. For this reason, mount_setattr(2) still does not allow for id-mappings to be changed. However, there was a bug in commit 2462651ffa76 ("fs: allow changing idmappings") which allowed users to bypass this restriction by calling open_tree_attr(2) *without* OPEN_TREE_CLONE. can_idmap_mount() prevented this bug from allowing an attached mountpoint's id-mapping from being modified (thanks to an is_anon_ns() check), but this still allows for detached (but visible) mounts to have their be id-mapping changed. This risks the same UAF and locking issues as described in the merge commit, and was likely unintentional.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-09-05 18:15:49.260000
Last modified
2026-10-19 21:10:00.160000
View original CVE JSON
{
"id": "CVE-2025-39717",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-09-05T18:15:49.260",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopen_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE\n\nAs described in commit 7a54947e727b ('Merge patch series \"fs: allow\nchanging idmappings\"'), open_tree_attr(2) was necessary in order to\nallow for a detached mount to be created and have its idmappings changed\nwithout the risk of any racing threads operating on it. For this reason,\nmount_setattr(2) still does not allow for id-mappings to be changed.\n\nHowever, there was a bug in commit 2462651ffa76 (\"fs: allow changing\nidmappings\") which allowed users to bypass this restriction by calling\nopen_tree_attr(2) *without* OPEN_TREE_CLONE.\n\ncan_idmap_mount() prevented this bug from allowing an attached\nmountpoint's id-mapping from being modified (thanks to an is_anon_ns()\ncheck), but this still allows for detached (but visible) mounts to have\ntheir be id-mapping changed. This risks the same UAF and locking issues\nas described in the merge commit, and was likely unintentional."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nopen_tree_attr: no permitir cambios de id-mapping sin OPEN_TREE_CLONE\n\nComo se describe en el commit 7a54947e727b ('Fusionar serie de parches “fs: permitir cambiar idmappings”'), open_tree_attr(2) era necesario para permitir que se creara un montaje desasociado y que sus idmappings fueran cambiados sin el riesgo de que ningún hilo en competencia operara sobre él. Por esta razón, mount_setattr(2) todavía no permite que los id-mappings sean cambiados.\n\nSin embargo, había un error en el commit 2462651ffa76 ('fs: permitir cambiar idmappings') que permitía a los usuarios eludir esta restricción llamando a open_tree_attr(2) *sin* OPEN_TREE_CLONE.\n\ncan_idmap_mount() impidió que este error permitiera que el id-mapping de un punto de montaje adjunto fuera modificado (gracias a una comprobación de is_anon_ns()), pero esto todavía permite que los montajes desasociados (pero visibles) tengan su id-mapping cambiado. Esto arriesga los mismos problemas de UAF y de bloqueo como se describe en el commit de fusión, y probablemente fue involuntario."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"fs/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2462651ffa76b87f9c2e4403ef6e6b89b703fb2f",
"lessThan": "69dbdc711d9130136824e3830191a6afffa0a1f0",
"versionType": "git",
"status": "affected"
},
{
"version": "2462651ffa76b87f9c2e4403ef6e6b89b703fb2f",
"lessThan": "9308366f062129d52e0ee3f7a019f7dd41db33df",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"fs/namespace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.15",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.15",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.16.4",
"lessThanOrEqual": "6.16.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15",
"versionEndExcluding": "6.16.4",
"matchCriteriaId": "7F0ABA2F-347D-450F-A06E-234E055E7302"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
"matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/69dbdc711d9130136824e3830191a6afffa0a1f0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9308366f062129d52e0ee3f7a019f7dd41db33df",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}