linux-cve-announce - CVE-2025-38282: kernfs: Relax constraint in draining guard

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025071010-CVE-2025-38282-78a1@gregkh>
Date: Thu, 10 Jul 2025 09:42:23 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38282: kernfs: Relax constraint in draining guard

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

kernfs: Relax constraint in draining guard

The active reference lifecycle provides the break/unbreak mechanism but
the active reference is not truly active after unbreak -- callers don't
use it afterwards but it's important for proper pairing of kn->active
counting. Assuming this mechanism is in place, the WARN check in
kernfs_should_drain_open_files() is too sensitive -- it may transiently
catch those (rightful) callers between
kernfs_unbreak_active_protection() and kernfs_put_active() as found out by Chen
Ridong:

	kernfs_remove_by_name_ns	kernfs_get_active // active=1
	__kernfs_remove					  // active=0x80000002
	kernfs_drain			...
	wait_event
	//waiting (active == 0x80000001)
					kernfs_break_active_protection
					// active = 0x80000001
	// continue
					kernfs_unbreak_active_protection
					// active = 0x80000002
	...
	kernfs_should_drain_open_files
	// warning occurs
					kernfs_put_active

To avoid the false positives (mind panic_on_warn) remove the check altogether.
(This is meant as quick fix, I think active reference break/unbreak may be
simplified with larger rework.)

The Linux kernel CVE team has assigned CVE-2025-38282 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1 with commit bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 and fixed in 6.1.142 with commit 2d6a67c2b3b87808a347dc1047b520a9dd177a4f
	Issue introduced in 6.1 with commit bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 and fixed in 6.6.94 with commit 6c81f1c7812c61f187bed1b938f1d2e391d503ab
	Issue introduced in 6.1 with commit bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 and fixed in 6.12.34 with commit 6bfb154f95d5f0ab7ed056f23aba8c1a94cb3927
	Issue introduced in 6.1 with commit bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 and fixed in 6.15.3 with commit 72275c888f8962b406ee9c6885c79bf68cca5a63
	Issue introduced in 6.1 with commit bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 and fixed in 6.16-rc1 with commit 071d8e4c2a3b0999a9b822e2eb8854784a350f8a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38282
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/kernfs/dir.c
	fs/kernfs/file.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2d6a67c2b3b87808a347dc1047b520a9dd177a4f
	https://git.kernel.org/stable/c/6c81f1c7812c61f187bed1b938f1d2e391d503ab
	https://git.kernel.org/stable/c/6bfb154f95d5f0ab7ed056f23aba8c1a94cb3927
	https://git.kernel.org/stable/c/72275c888f8962b406ee9c6885c79bf68cca5a63
	https://git.kernel.org/stable/c/071d8e4c2a3b0999a9b822e2eb8854784a350f8a