CVE-2025-40072

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing

The function do_fanotify_mark() does not validate if

mnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns.

This causes a NULL pointer dereference in do_fanotify_mark() if the

path is not a mount namespace object.

Fix this by checking mnt_ns_from_dentry()'s return value before

dereferencing it.

Before the patch

$ gcc fanotify_nullptr.c -o fanotify_nullptr

$ mkdir A

$ ./fanotify_nullptr

Fanotify fd: 3

fanotify_mark: Operation not permitted

$ unshare -Urm

Fanotify fd: 3

Killed

int main(void){

int ffd;

ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);

if(ffd < 0){

perror("fanotify_init");

exit(EXIT_FAILURE);

}

printf("Fanotify fd: %d\n",ffd);

if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS,

FAN_MNT_ATTACH, AT_FDCWD, "A") < 0){

perror("fanotify_mark");

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References