Cloudanix VulnDB

CVE-2025-38282

None

CVSS

—

EPSS

0.2%

Published

Jul 10, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug could cause unnecessary warnings or crashes during normal file operations, so updating the kernel removes the overly strict check and prevents surprises.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Overly sensitive WARN check in kernfs_should_drain_open_files() triggers false positives during legitimate active reference break/unbreak lifecycle between kernfs_unbreak_active_protection() and kernfs_put_active(), risking warnings or panic_on_warn in kernfs removal paths.

Why it matters to the business

Linux kernel instability or unexpected panics during normal filesystem operations can cause system downtime and increased operational overhead, especially in environments with high kernfs usage; urgency is low given no KEV listing or ransomware use.

How an attack unfolds

An attacker triggers concurrent kernfs_remove_by_name_ns and active protection operations to hit the transient window, but the condition only produces false warnings rather than code execution; listed threat actors such as Advanced Spyware Campaign or September 2025 Active Exploitation Campaigns have no confirmed link to this issue.

How to fix it

Upgrade affected packages to fixed versions: linux-lts (Alpaquita:stream) to 6.6.58-r0, linux-lts (Alpaquita:23) to 6.1.62-r0, or kernel GIT to commit 2d6a67c2b3b87808a347dc1047b520a9dd177a4f; apply the quick-fix removal of the sensitive check.

How to confirm the fix worked

Verify kernel version or commit matches fixed revisions; confirm absence of the WARN check in kernfs_should_drain_open_files() and test concurrent remove/active-protection workloads without false positives.

Typical attack path

  1. Identify target system with vulnerable kernfs implementation
  2. Perform concurrent kernfs removal and active reference operations
  3. Trigger the WARN in kernfs_should_drain_open_files() during unbreak window

How to detect it

Search kernel logs for WARN messages from kernfs_should_drain_open_files during removal operations; correlate with kernfs_remove_by_name_ns and active reference break/unbreak sequences; no confirmed exploitation artifacts exist.

  • kernfs_should_drain_open_files
  • kernfs_unbreak_active_protection
  • active == 0x80000002

What your security team should do

  • Prioritize patching Linux kernel packages to the listed fixed versions within standard maintenance windows
  • Monitor for WARN logs related to kernfs_drain and active references
  • Review downstream dependents for rebuilds against updated kernels

The record

In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining guard The active reference lifecycle provides the break/unbreak mechanism but the active reference is not truly active after unbreak -- callers don't use it afterwards but it's important for proper pairing of kn->active counting. Assuming this mechanism is in place, the WARN check in kernfs_should_drain_open_files() is too sensitive -- it may transiently catch those (rightful) callers between kernfs_unbreak_active_protection() and kernfs_put_active() as found out by Chen Ridong: kernfs_remove_by_name_ns kernfs_get_active // active=1 __kernfs_remove // active=0x80000002 kernfs_drain ... wait_event //waiting (active == 0x80000001) kernfs_break_active_protection // active = 0x80000001 // continue kernfs_unbreak_active_protection // active = 0x80000002 ... kernfs_should_drain_open_files // warning occurs kernfs_put_active To avoid the false positives (mind panic_on_warn) remove the check altogether. (This is meant as quick fix, I think active reference break/unbreak may be simplified with larger rework.)

Affected packages

Ecosystem Package Introduced Fixed
Debian:12 linux 0 No fix
Debian:13 linux 0 6.12.35-1
Debian:14 linux 0 6.12.35-1
Linux Kernel 6.1.0 6.1.142
Mageia:9 kernel 0 6.6.101-1.mga9
Mageia:9 kernel-linus 0 6.6.101-1.mga9
Mageia:9 kmod-virtualbox 0 7.1.10-7.mga9
Mageia:9 kmod-xtables-addons 0 3.24-83.mga9
Mageia:9 wireless-regdb 0 20250710-1.mga9

Related vulnerabilities