Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-22072— spufs: fix gang directory lifetimes

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于gang目录生命周期管理不当，可能导致泄漏。

CVSS 7.8 · High EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1620 · Reflective Code Loading

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 877907d37da9694a34adc9dc3e2ce09400148cb5< 880e7b3da2e765c1f90c94c0539be039e96c7062 affected
877907d37da9694a34adc9dc3e2ce09400148cb5< 324f280806aab28ef757aecc18df419676c10ef8 affected
877907d37da9694a34adc9dc3e2ce09400148cb5< 029d8c711f5e5fe8cf63e8a4a1a140a06e224e45 affected
877907d37da9694a34adc9dc3e2ce09400148cb5< 903733782f3ae28a2f7fe4dfb47c7fe3e079a528 affected
877907d37da9694a34adc9dc3e2ce09400148cb5< fc646a6c6d14b5d581f162a7e32999f789e3a3ac affected
877907d37da9694a34adc9dc3e2ce09400148cb5< c134deabf4784e155d360744d4a6a835b9de4dd4 affected
2.6.22 affected
< 2.6.22 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-22072

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
spufs: fix gang directory lifetimes
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: spufs: fix gang directory lifetimes prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have a problem with gang lifetimes - creation of a gang returns opened gang directory, which normally gets removed when that gets closed, but if somebody has created a context belonging to that gang and kept it alive until the gang got closed, removal failed and we ended up with a leak. Unfortunately, it had been fixed the wrong way. Dentry of gang directory was no longer pinned, and rmdir on close was gone. One problem was that failure of open kept calling simple_rmdir() as cleanup, which meant an unbalanced dput(). Another bug was in the success case - gang creation incremented link count on root directory, but that was no longer undone when gang got destroyed. Fix consists of * reverting the commit in question * adding a counter to gang, protected by ->i_rwsem of gang directory inode. * having it set to 1 at creation time, dropped in both spufs_dir_close() and spufs_gang_close() and bumped in spufs_create_context(), provided that it's not 0. * using simple_recursive_removal() to take the gang directory out when counter reaches zero.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于gang目录生命周期管理不当，可能导致泄漏。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 877907d37da9694a34adc9dc3e2ce09400148cb5 ~ 880e7b3da2e765c1f90c94c0539be039e96c7062 -
Linux Linux 2.6.22 -

II. Public POCs for CVE-2025-22072

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-22072

请登录查看更多情报信息。

Other References for CVE-2025-22072 (6)

Same Patch Batch · Linux · 2025-04-16 · 127 CVEs total

CVE-2025-22021 10.0 CRITICAL netfilter: socket: Lookup orig tuple for IPv6 SNAT
CVE-2025-22077 9.8 CRITICAL Revert "smb: client: fix TCP timers deadlock after rmmod"
CVE-2025-22110 9.8 CRITICAL netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error
CVE-2025-22088 9.8 CRITICAL RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
CVE-2025-22118 8.8 HIGH ice: validate queue quanta parameters to prevent OOB access
CVE-2025-22074 8.8 HIGH ksmbd: fix r_count dec/increment mismatch
CVE-2025-22040 8.8 HIGH ksmbd: fix session use-after-free in multichannel connection
CVE-2025-22041 8.8 HIGH ksmbd: fix use-after-free in ksmbd_sessions_deregister()
CVE-2025-22039 8.8 HIGH ksmbd: fix overflow in dacloffset bounds check
CVE-2024-58096 8.8 HIGH wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode
CVE-2025-22086 8.8 HIGH RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
CVE-2025-23133 8.8 HIGH wifi: ath11k: update channel list in reg notifier instead reg worker
CVE-2025-22117 8.7 HIGH ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()
CVE-2025-22108 8.6 HIGH bnxt_en: Mask the bd_cnt field in the TX BD properly
CVE-2025-22121 8.4 HIGH ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()
CVE-2025-22080 8.4 HIGH fs/ntfs3: Prevent integer overflow in hdr_first_de()
CVE-2025-22038 8.3 HIGH ksmbd: validate zero num_subauth before sub_auth is accessed
CVE-2025-22042 8.1 HIGH ksmbd: add bounds check for create lease context
CVE-2025-22043 8.1 HIGH ksmbd: add bounds check for durable handle context
CVE-2025-22124 7.8 HIGH md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb

Showing top 20 of 127 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-22072

No comments yet

Leave a comment