CVE-2025-37988

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount()

Normally do_lock_mount(path, _) is locking a mountpoint pinned by

*path and at the time when matching unlock_mount() unlocks that

location it is still pinned by the same thing.

Unfortunately, for 'beneath' case it's no longer that simple -

the object being locked is not the one *path points to. It's the

mountpoint of path->mnt. The thing is, without sufficient locking

->mnt_parent may change under us and none of the locks are held

at that point. The rules are

* mount_lock stabilizes m->mnt_parent for any mount m.

* namespace_sem stabilizes m->mnt_parent, provided that

m is mounted.

* if either of the above holds and refcount of m is positive,

we are guaranteed the same for refcount of m->mnt_parent.

namespace_sem nests inside inode_lock(), so do_lock_mount() has

to take inode_lock() before grabbing namespace_sem. It does

recheck that path-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References