CVE-2025-38282

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kernfs: Relax constraint in draining guard

The active reference lifecycle provides the break/unbreak mechanism but

the active reference is not truly active after unbreak -- callers don't

use it afterwards but it's important for proper pairing of kn->active

counting. Assuming this mechanism is in place, the WARN check in

kernfs_should_drain_open_files() is too sensitive -- it may transiently

catch those (rightful) callers between

kernfs_unbreak_active_protection() and kernfs_put_active() as found out by Chen

Ridong:

kernfs_remove_by_name_ns kernfs_get_active // active=1

__kernfs_remove // active=0x80000002

kernfs_drain ...

wait_event

//waiting (active == 0x80000001)

kernfs_break_active_protection

// active = 0x80000001

// continue

kernfs_unbreak_active_protection

// active = 0x80000002

...

kernfs_should_drain_open_files

// warning occurs

kernfs_put_active

To avoid the false

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References