CVE-2025-38396— fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
Affected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 2bfe15c5261212130f1a71f32a300bcf426443d4< 66d29d757c968d2bee9124816da5d718eb352959 | affected |
2bfe15c5261212130f1a71f32a300bcf426443d4< e3eed01347721cd7a8819568161c91d538fbf229 | affected | ||
2bfe15c5261212130f1a71f32a300bcf426443d4< f94c422157f3e43dd31990567b3e5d54b3e5b32b | affected | ||
2bfe15c5261212130f1a71f32a300bcf426443d4< 6ca45ea48530332a4ba09595767bd26d3232743b | affected | ||
2bfe15c5261212130f1a71f32a300bcf426443d4< cbe4134ea4bc493239786220bd69cb8a13493190 | affected | ||
6.0 | affected | ||
< 6.0 | unaffected | ||
6.1.146≤ 6.1.* | unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-38396
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon() for creating security context manually. This change also fixes a security regression in secretmem where the S_PRIVATE flag was not cleared after alloc_anon_inode(), causing LSM/SELinux checks to be bypassed for secretmem file descriptors. As guest_memfd currently resides in the KVM module, we need to export this symbol for use outside the core kernel. In the future, guest_memfd might be moved to core-mm, at which point the symbols no longer would have to be exported. When/if that happens is still unclear.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于anon_inode安全上下文处理不当可能导致LSM绕过。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-38396
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-38396
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-07-25 · 114 CVEs total
| CVE-2025-38429 | 10.0 CRITICAL | bus: mhi: ep: Update read pointer only after buffer is written |
| CVE-2025-38411 | 9.8 CRITICAL | netfs: Fix double put of request |
| CVE-2025-38430 | 9.8 CRITICAL | nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request |
| CVE-2025-38439 | 9.8 CRITICAL | bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT |
| CVE-2025-38365 | 9.1 CRITICAL | btrfs: fix a race between renames and directory logging |
| CVE-2025-38437 | 8.8 HIGH | ksmbd: fix potential use-after-free in oplock/lease break ack |
| CVE-2025-38377 | 8.8 HIGH | rose: fix dangling neighbour pointers in rose_rt_device_down() |
| CVE-2025-38367 | 8.8 HIGH | LoongArch: KVM: Avoid overflow with array index |
| CVE-2025-38395 | 8.4 HIGH | regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods |
| CVE-2025-38375 | 8.4 HIGH | virtio-net: ensure the received length does not exceed allocated size |
| CVE-2025-38434 | 7.8 HIGH | Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" |
| CVE-2025-38398 | 7.8 HIGH | spi: spi-qpic-snand: reallocate BAM transactions |
| CVE-2025-38449 | 7.8 HIGH | drm/gem: Acquire references on GEM handles for framebuffers |
| CVE-2025-38382 | 7.8 HIGH | btrfs: fix iteration of extrefs during log replay |
| CVE-2025-38412 | 7.8 HIGH | platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks |
| CVE-2025-38422 | 7.8 HIGH | net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices |
| CVE-2025-38440 | 7.8 HIGH | net/mlx5e: Fix race between DIM disable and net_dim() |
| CVE-2025-38408 | 7.8 HIGH | genirq/irq_sim: Initialize work context pointers properly |
| CVE-2025-38401 | 7.8 HIGH | mtk-sd: Prevent memory corruption from DMA map failure |
| CVE-2025-38447 | 7.8 HIGH | mm/rmap: fix potential out-of-bounds page table access during batched unmap |
Showing top 20 of 114 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-68081
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to - CVE-2026-68082
libceph: fix two unsafe bare decodes in decode_lockers() - CVE-2026-68480
x86/bugs: Make Safe-RET robust against interrupt injection - CVE-2026-64604
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is - CVE-2026-64602
iio: adc: spear: Initialize completion before requesting IRQ
Same vendor: Linux
- CVE-2026-68081
KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to - CVE-2026-68082
libceph: fix two unsafe bare decodes in decode_lockers() - CVE-2026-68480
x86/bugs: Make Safe-RET robust against interrupt injection - CVE-2026-64604
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is - CVE-2026-64602
iio: adc: spear: Initialize completion before requesting IRQ
V. Comments for CVE-2025-38396
No comments yet