LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38411: netfs: Fix double put of request

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix double put of request If a netfs request finishes during the pause loop, it will have the ref that belongs to the IN_PROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will *also* put the ref because it sees that the IN_PROGRESS flag is clear and incorrectly assumes that this happened when it called the collector. In fact, since IN_PROGRESS is clear, we shouldn't call the collector again since it's done all the cleanup, such as calling ->ki_complete(). Fix this by making netfs_collect_in_app() just return, indicating that we're done if IN_PROGRESS is removed.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux kernel netfs request can be released twice when completion races with pause and final-wait processing. This may destabilize affected systems or corrupt kernel memory. The supplied record rates it critical, but does not establish which deployed distributions are vulnerable or demonstrate remote exploitation.

Executive priority

Prioritize prompt exposure assessment because kernel reference-handling faults can have system-wide consequences. Accelerate patching where vendors confirm affected kernels, especially on important systems using netfs paths. Do not infer internet-wide remote compromise solely from the critical score; the supplied evidence does not confirm practical exploitation.

Technical view

The flaw occurs when a netfs request completes during a pause loop. Its IN_PROGRESS reference is removed, then final-wait logic can incorrectly remove the reference again after observing the cleared flag. The fix makes netfs_collect_in_app() return when IN_PROGRESS is already removed, avoiding repeated collection and cleanup.

Likely exposure

Exposure is limited to Linux kernels containing the vulnerable netfs logic and workloads reaching that request path. The bundle lists commit identifiers and Linux 6.15.3 with default status marked unaffected, but provides no clear vulnerable version range or distribution mapping. Inventory and vendor confirmation are required.

Exploitation context

The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public proof of concept. Although the supplied CVSS vector describes network reachability without privileges or interaction, the technical narrative does not establish a remotely accessible trigger. Treat exploitability as unconfirmed.

Researcher notes

The record describes a race-dependent double reference release and duplicate collector cleanup, including possible repeated ->ki_complete() handling. Exact security impact, trigger conditions, affected version boundaries, and distribution backports are not documented in the bundle. The affected entries are also marked defaultStatus unaffected, so commit-level and vendor-package verification is essential.

Mitigation direction

  • Check Linux distribution advisories for affected package versions and backported fixes.
  • Update to a vendor-supported kernel confirmed to contain the cited netfs correction.
  • Prioritize systems using netfs-backed filesystems or related request paths.
  • Use vendor-recommended mitigations if immediate kernel replacement is unavailable.

Validation and detection

  • Record running kernel and installed kernel package versions across Linux systems.
  • Compare versions against distribution advisories and the cited stable-kernel commits.
  • Confirm patched source makes netfs_collect_in_app() return when IN_PROGRESS is removed.
  • After updating, verify systems booted the corrected kernel and rerun normal filesystem workloads.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38411 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2025-38411Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux329ba1cb402ac328224965b8fc7a554a5150908e, 2b1424cd131cfaba4cf7040473133d26cddac088unaffected
LinuxLinux6.15.3unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.