CVE-2025-39717 (GCVE-0-2025-39717)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:21 – Updated: 2026-08-05 12:04
VLAI
Title
open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
Summary
In the Linux kernel, the following vulnerability has been resolved: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE As described in commit 7a54947e727b ('Merge patch series "fs: allow changing idmappings"'), open_tree_attr(2) was necessary in order to allow for a detached mount to be created and have its idmappings changed without the risk of any racing threads operating on it. For this reason, mount_setattr(2) still does not allow for id-mappings to be changed. However, there was a bug in commit 2462651ffa76 ("fs: allow changing idmappings") which allowed users to bypass this restriction by calling open_tree_attr(2) *without* OPEN_TREE_CLONE. can_idmap_mount() prevented this bug from allowing an attached mountpoint's id-mapping from being modified (thanks to an is_anon_ns() check), but this still allows for detached (but visible) mounts to have their be id-mapping changed. This risks the same UAF and locking issues as described in the merge commit, and was likely unintentional.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2462651ffa76b87f9c2e4403ef6e6b89b703fb2f , < 69dbdc711d9130136824e3830191a6afffa0a1f0 (git)
Affected: 2462651ffa76b87f9c2e4403ef6e6b89b703fb2f , < 9308366f062129d52e0ee3f7a019f7dd41db33df (git)
Create a notification for this product.
Linux Linux Affected: 6.15
Unaffected: 0 , < 6.15 (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69dbdc711d9130136824e3830191a6afffa0a1f0",
              "status": "affected",
              "version": "2462651ffa76b87f9c2e4403ef6e6b89b703fb2f",
              "versionType": "git"
            },
            {
              "lessThan": "9308366f062129d52e0ee3f7a019f7dd41db33df",
              "status": "affected",
              "version": "2462651ffa76b87f9c2e4403ef6e6b89b703fb2f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "lessThan": "6.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopen_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE\n\nAs described in commit 7a54947e727b (\u0027Merge patch series \"fs: allow\nchanging idmappings\"\u0027), open_tree_attr(2) was necessary in order to\nallow for a detached mount to be created and have its idmappings changed\nwithout the risk of any racing threads operating on it. For this reason,\nmount_setattr(2) still does not allow for id-mappings to be changed.\n\nHowever, there was a bug in commit 2462651ffa76 (\"fs: allow changing\nidmappings\") which allowed users to bypass this restriction by calling\nopen_tree_attr(2) *without* OPEN_TREE_CLONE.\n\ncan_idmap_mount() prevented this bug from allowing an attached\nmountpoint\u0027s id-mapping from being modified (thanks to an is_anon_ns()\ncheck), but this still allows for detached (but visible) mounts to have\ntheir be id-mapping changed. This risks the same UAF and locking issues\nas described in the merge commit, and was likely unintentional."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached purely through local syscalls \u2014 `open_tree(2)` to create a detached mount and `open_tree_attr(2)` to replace its idmapping. There is no remote or adjacent-network path to fs/namespace.c mount attribute handling.\nAC:L - The attacker controls both sides of the race entirely: one thread calls `open_tree_attr()` to free the old `struct mnt_idmap` while attacker-spawned threads hammer `openat()`/`statx()`/`open_tree(OPEN_TREE_CLONE)` on the same detached-mount fd, and the replace can be repeated in a loop with a heap spray of the kmalloc-cg-192 slab.\nPR:L - Only an unprivileged local user is required \u2014 `unshare -Urm` grants CAP_SYS_ADMIN over both the new mount namespace (satisfying `may_mount()`) and over the superblock\u0027s `s_user_ns` (satisfying `can_idmap_mount()`) for a self-mounted tmpfs or fuse filesystem, both of which carry `FS_USERNS_MOUNT | FS_ALLOW_IDMAP`.\nUI:N - The attacker performs every step \u2014 creating the detached mount, applying the first idmapping, and racing the replacement \u2014 within its own processes. No victim action of any kind is needed.\nS:U - The freed object and all corrupted state live in the kernel\u0027s own memory; the impact is confined to the kernel security authority with no crossing of a VM, IOMMU, or hypervisor boundary.\nC:H - This is a use-after-free on a heap object whose contents directly determine mapped uid/gid values, so refilling the freed slot lets the attacker forge `uid_gid_map.forward` into an arbitrary kernel pointer that `bsearch()` dereferences, with the result observable via `stat()` \u2014 an arbitrary kernel memory read.\nI:H - `clone_mnt()`\u0027s `mnt_idmap_get()` performs a `refcount_inc()` on the freed object, giving a write primitive into reclaimed heap memory, and the stale/forged idmapping also causes ownership and permission decisions to be made from attacker-influenced data.\nA:H - Dereferencing the freed `struct mnt_idmap` and its `kfree()`d extent arrays, plus refcount underflow and double-free on repeated replacement, reliably produce an oops or panic taking down the whole system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:48.428Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69dbdc711d9130136824e3830191a6afffa0a1f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9308366f062129d52e0ee3f7a019f7dd41db33df"
        }
      ],
      "title": "open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39717",
    "datePublished": "2025-09-05T17:21:24.528Z",
    "dateReserved": "2025-04-16T07:20:57.117Z",
    "dateUpdated": "2026-08-05T12:04:48.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39717",
      "date": "2026-08-05",
      "epss": "0.00141",
      "percentile": "0.03929"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39717\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-05T18:15:49.260\",\"lastModified\":\"2026-07-30T06:23:42.693\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nopen_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE\\n\\nAs described in commit 7a54947e727b (\u0027Merge patch series \\\"fs: allow\\nchanging idmappings\\\"\u0027), open_tree_attr(2) was necessary in order to\\nallow for a detached mount to be created and have its idmappings changed\\nwithout the risk of any racing threads operating on it. For this reason,\\nmount_setattr(2) still does not allow for id-mappings to be changed.\\n\\nHowever, there was a bug in commit 2462651ffa76 (\\\"fs: allow changing\\nidmappings\\\") which allowed users to bypass this restriction by calling\\nopen_tree_attr(2) *without* OPEN_TREE_CLONE.\\n\\ncan_idmap_mount() prevented this bug from allowing an attached\\nmountpoint\u0027s id-mapping from being modified (thanks to an is_anon_ns()\\ncheck), but this still allows for detached (but visible) mounts to have\\ntheir be id-mapping changed. This risks the same UAF and locking issues\\nas described in the merge commit, and was likely unintentional.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/namespace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2462651ffa76b87f9c2e4403ef6e6b89b703fb2f\",\"lessThan\":\"69dbdc711d9130136824e3830191a6afffa0a1f0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2462651ffa76b87f9c2e4403ef6e6b89b703fb2f\",\"lessThan\":\"9308366f062129d52e0ee3f7a019f7dd41db33df\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/namespace.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.4\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.15\",\"versionEndExcluding\":\"6.16.4\",\"matchCriteriaId\":\"7F0ABA2F-347D-450F-A06E-234E055E7302\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/69dbdc711d9130136824e3830191a6afffa0a1f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9308366f062129d52e0ee3f7a019f7dd41db33df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:57:27+00:00",
      "cve": "CVE-2025-39717",
      "id": "CVE-2025-39717",
      "initial_release_date": "2025-09-05T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39717.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-05-20T02:50:12Z",
      "cve": "CVE-2025-39717",
      "id": "CVE-2025-39717",
      "initial_release_date": "2025-09-08T23:22:17Z",
      "product_status:known_not_affected": "345",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-39717",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-39717.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.