CVE-2025-38396 (GCVE-0-2025-38396)

Vulnerability from cvelistv5 – Published: 2025-07-25 12:53 – Updated: 2026-08-05 12:01
VLAI
Title
fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
Summary
In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon() for creating security context manually. This change also fixes a security regression in secretmem where the S_PRIVATE flag was not cleared after alloc_anon_inode(), causing LSM/SELinux checks to be bypassed for secretmem file descriptors. As guest_memfd currently resides in the KVM module, we need to export this symbol for use outside the core kernel. In the future, guest_memfd might be moved to core-mm, at which point the symbols no longer would have to be exported. When/if that happens is still unclear.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < 66d29d757c968d2bee9124816da5d718eb352959 (git)
Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < e3eed01347721cd7a8819568161c91d538fbf229 (git)
Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < f94c422157f3e43dd31990567b3e5d54b3e5b32b (git)
Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < 6ca45ea48530332a4ba09595767bd26d3232743b (git)
Affected: 2bfe15c5261212130f1a71f32a300bcf426443d4 , < cbe4134ea4bc493239786220bd69cb8a13493190 (git)
Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.1.146 , ≤ 6.1.* (semver)
Unaffected: 6.6.97 , ≤ 6.6.* (semver)
Unaffected: 6.12.37 , ≤ 6.12.* (semver)
Unaffected: 6.15.6 , ≤ 6.15.* (semver)
Unaffected: 6.16 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:37:29.745Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/anon_inodes.c",
            "include/linux/fs.h",
            "mm/secretmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66d29d757c968d2bee9124816da5d718eb352959",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "e3eed01347721cd7a8819568161c91d538fbf229",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "f94c422157f3e43dd31990567b3e5d54b3e5b32b",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "6ca45ea48530332a4ba09595767bd26d3232743b",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            },
            {
              "lessThan": "cbe4134ea4bc493239786220bd69cb8a13493190",
              "status": "affected",
              "version": "2bfe15c5261212130f1a71f32a300bcf426443d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/anon_inodes.c",
            "include/linux/fs.h",
            "mm/secretmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.97",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.37",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.6",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass\n\nExport anon_inode_make_secure_inode() to allow KVM guest_memfd to create\nanonymous inodes with proper security context. This replaces the current\npattern of calling alloc_anon_inode() followed by\ninode_init_security_anon() for creating security context manually.\n\nThis change also fixes a security regression in secretmem where the\nS_PRIVATE flag was not cleared after alloc_anon_inode(), causing\nLSM/SELinux checks to be bypassed for secretmem file descriptors.\n\nAs guest_memfd currently resides in the KVM module, we need to export this\nsymbol for use outside the core kernel. In the future, guest_memfd might be\nmoved to core-mm, at which point the symbols no longer would have to be\nexported. When/if that happens is still unclear."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable object is created and operated on through local syscalls \u2014 `memfd_secret(2)`, `mmap()`, and `ftruncate()` on the resulting file descriptor. No network or adjacent-network path exists.\nAC:L - Every secretmem inode is unconditionally created with S_PRIVATE set \u2014 there is no race, no memory-layout dependency, and no timing element; the attacker simply calls memfd_secret() or receives such an fd. CONFIG_SECRETMEM defaults to y and secretmem_enable defaults to 1 since 6.6, so the affected path is present in stock distro kernels.\nPR:L - memfd_secret(2) performs no capability or permission check whatsoever, so any unprivileged local user \u2014 including one confined inside a container or user namespace \u2014 can create and operate on secretmem fds. Local account access is still required, so this is not PR:N.\nUI:N - The attacker triggers the entire sequence from their own process; no victim action, mount, or file open is needed.\nS:U - The missing enforcement affects kernel-managed objects under the kernel\u0027s own security authority; no VM, IOMMU, or hypervisor boundary is crossed. Per standard kernel scoring, MAC-policy enforcement failures remain Unchanged.\nC:H - With S_PRIVATE set, SELinux inode_has_perm() and Smack\u0027s checks return 0, so FILE__READ/FILE__MAP on a secretmem object are never evaluated \u2014 a confined domain that receives such an fd can mmap and read its contents despite policy denying it. secretmem is by design the store for the system\u0027s most sensitive data (crypto keys), and the accesses generate no AVC audit records.\nI:H - The same bypass permits PROT_WRITE shared mappings, and security_inode_setattr() is skipped entirely, so ftruncate/chown/chmod on a policy-protected secretmem object go unmediated. An attacker can overwrite or re-own another security domain\u0027s key material that the MAC policy was configured to protect.\nA:H - Because setattr and write-mapping are both unmediated, an attacker can truncate and overwrite the secretmem object a victim service depends on, destroying its key material and causing that service to fail; the unreclaimable, unmovable nature of secretmem pages compounds the effect."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:34.204Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66d29d757c968d2bee9124816da5d718eb352959"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3eed01347721cd7a8819568161c91d538fbf229"
        },
        {
          "url": "https://git.kernel.org/stable/c/f94c422157f3e43dd31990567b3e5d54b3e5b32b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ca45ea48530332a4ba09595767bd26d3232743b"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbe4134ea4bc493239786220bd69cb8a13493190"
        }
      ],
      "title": "fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38396",
    "datePublished": "2025-07-25T12:53:40.761Z",
    "dateReserved": "2025-04-16T04:51:24.011Z",
    "dateUpdated": "2026-08-05T12:01:34.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38396",
      "date": "2026-08-04",
      "epss": "0.00163",
      "percentile": "0.05927"
    },
    "microsoft_vex": {
      "current_release_date": "2025-09-03T22:07:59.000Z",
      "cve": "CVE-2025-38396",
      "id": "msrc_CVE-2025-38396",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38396.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38396\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-25T13:15:29.077\",\"lastModified\":\"2026-07-30T06:23:11.987\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass\\n\\nExport anon_inode_make_secure_inode() to allow KVM guest_memfd to create\\nanonymous inodes with proper security context. This replaces the current\\npattern of calling alloc_anon_inode() followed by\\ninode_init_security_anon() for creating security context manually.\\n\\nThis change also fixes a security regression in secretmem where the\\nS_PRIVATE flag was not cleared after alloc_anon_inode(), causing\\nLSM/SELinux checks to be bypassed for secretmem file descriptors.\\n\\nAs guest_memfd currently resides in the KVM module, we need to export this\\nsymbol for use outside the core kernel. In the future, guest_memfd might be\\nmoved to core-mm, at which point the symbols no longer would have to be\\nexported. When/if that happens is still unclear.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs: exportar anon_inode_make_secure_inode() y corregir la omisi\u00f3n de LSM de secretmem Exportar anon_inode_make_secure_inode() para permitir que KVM guest_memfd cree inodos an\u00f3nimos con el contexto de seguridad adecuado. Esto reemplaza el patr\u00f3n actual de llamar a alloc_anon_inode() seguido de inode_init_security_anon() para crear el contexto de seguridad manualmente. Este cambio tambi\u00e9n corrige una regresi\u00f3n de seguridad en secretmem donde el indicador S_PRIVATE no se borr\u00f3 despu\u00e9s de alloc_anon_inode(), lo que provoc\u00f3 que se omitieran las comprobaciones de LSM/SELinux para los descriptores de archivos de secretmem. Como guest_memfd reside actualmente en el m\u00f3dulo KVM, necesitamos exportar este s\u00edmbolo para su uso fuera del n\u00facleo del kernel. En el futuro, guest_memfd podr\u00eda moverse a core-mm, en cuyo punto los s\u00edmbolos ya no tendr\u00edan que exportarse. Cu\u00e1ndo/si eso sucede a\u00fan no est\u00e1 claro.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/anon_inodes.c\",\"include/linux/fs.h\",\"mm/secretmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2bfe15c5261212130f1a71f32a300bcf426443d4\",\"lessThan\":\"66d29d757c968d2bee9124816da5d718eb352959\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2bfe15c5261212130f1a71f32a300bcf426443d4\",\"lessThan\":\"e3eed01347721cd7a8819568161c91d538fbf229\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2bfe15c5261212130f1a71f32a300bcf426443d4\",\"lessThan\":\"f94c422157f3e43dd31990567b3e5d54b3e5b32b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2bfe15c5261212130f1a71f32a300bcf426443d4\",\"lessThan\":\"6ca45ea48530332a4ba09595767bd26d3232743b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2bfe15c5261212130f1a71f32a300bcf426443d4\",\"lessThan\":\"cbe4134ea4bc493239786220bd69cb8a13493190\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/anon_inodes.c\",\"include/linux/fs.h\",\"mm/secretmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.146\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.97\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.37\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15.6\",\"lessThanOrEqual\":\"6.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.1.146\",\"matchCriteriaId\":\"4F0340C7-B3B7-4007-B73C-E0A1C597D4EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.97\",\"matchCriteriaId\":\"EB1BB991-B903-4718-966C-07C803CBEABC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.37\",\"matchCriteriaId\":\"6B4159AA-C70D-4DE5-9EE2-8F2728F13C5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.15.6\",\"matchCriteriaId\":\"6E0BB4E0-44BC-4645-83A8-6EA232CE624C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D4894DB-CCFE-4602-B1BF-3960B2E19A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"09709862-E348-4378-8632-5A7813EDDC86\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"415BF58A-8197-43F5-B3D7-D1D63057A26E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A0517869-312D-4429-80C2-561086E1421C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/66d29d757c968d2bee9124816da5d718eb352959\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6ca45ea48530332a4ba09595767bd26d3232743b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cbe4134ea4bc493239786220bd69cb8a13493190\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e3eed01347721cd7a8819568161c91d538fbf229\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f94c422157f3e43dd31990567b3e5d54b3e5b32b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:13:52+00:00",
      "cve": "CVE-2025-38396",
      "id": "CVE-2025-38396",
      "initial_release_date": "2025-07-25T00:00:00+00:00",
      "product_status:fixed": "610",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38396.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T00:46:52Z",
      "cve": "CVE-2025-38396",
      "id": "CVE-2025-38396",
      "initial_release_date": "2025-07-28T23:23:48Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "440",
      "product_status:known_not_affected": "283",
      "product_status:recommended": "607",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38396",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38396.json",
      "version": "58"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.