CVE-2025-38306

What it actually does

Race condition in may_decode_fh() allowing unsynchronized call to has_locked_children() without holding mount_lock or namespace_sem, leading to potential use-after-free or invalid mount reference and kernel oops.

Why it matters to the business

Linux kernel crashes or system instability on affected distributions can interrupt services, cause data loss during operations, and require reboots; prevalence across many Linux deployments increases operational risk.

How an attack unfolds

An attacker with local access triggers concurrent filesystem handle decoding operations while the kernel performs mount namespace changes; the missing lock allows the race window to dereference an invalid mount structure, resulting in a crash.

How to fix it

Upgrade to fixed kernel versions: linux-lts 6.1.81-r0 or later, 6.6.58-r0 or later, 6.12.41-r0 or later, or mainline commit 6482c3dccbfb8d20e2856ce67c75856859930b3f; apply vendor patches and reboot.

How to confirm the fix worked

Confirm kernel version is at or above the listed fixed releases; review fs/fhandle.c and fs/namespace.c for presence of the __has_locked_children wrapper under read_seqlock_excl(&mount_lock); test with concurrent fhandle and mount operations.

Typical attack path

1. Obtain local unprivileged access on affected Linux system
2. Perform concurrent NFS file handle decode and mount namespace manipulation operations
3. Trigger the unsynchronized has_locked_children() path to hit the race
4. Cause kernel oops and potential denial of service

How to detect it

Review kernel logs for oops traces referencing has_locked_children, may_decode_fh, or fhandle.c; correlate with mount namespace activity in audit logs; no specific post-exploitation artifacts beyond crash dumps.

What your security team should do

• Prioritize patching production Linux systems to the fixed kernel versions within maintenance windows
• Monitor EPSS trend and any new exploit maturity reports for increased urgency
• Apply defense-in-depth with seccomp and namespace isolation to limit local trigger surfaces
• Schedule kernel updates across all affected Alpaquita and stable distributions