CVE-2025-22072

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

spufs: fix gang directory lifetimes

prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have

a problem with gang lifetimes - creation of a gang returns opened

gang directory, which normally gets removed when that gets closed,

but if somebody has created a context belonging to that gang and

kept it alive until the gang got closed, removal failed and we

ended up with a leak.

Unfortunately, it had been fixed the wrong way. Dentry of gang

directory was no longer pinned, and rmdir on close was gone.

One problem was that failure of open kept calling simple_rmdir()

as cleanup, which meant an unbalanced dput(). Another bug was

in the success case - gang creation incremented link count on

root directory, but that was no longer undone when gang got

destroyed.

Fix consists of

* reverting the commit in question

* adding a counter to gang, protected by ->i_rwsem

of gang directory inode.

* having it set to 1 at cr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References