SECUFOCUSNOW
Home›CVE index›CVE-2025-38396
Review reviewHigh

CVE-2025-38396

Linux Linux, linux kernel, debian linux

In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon() for creating security context manually. This change also fixes a security regression in secretmem where the S_PRIVATE flag was not cleared after alloc_anon_inode(), causing LSM/SELinux checks to be bypassed for secretmem file descripto...

CVSS
7.8
EPSS
0.16%
5.91% percentile
CISA KEV
Not listed
Published
2025.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.16%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon() for creating security context manually. This change also fixes a security regression in secretmem where the S_PRIVATE flag was not cleared after alloc_anon_inode(), causing LSM/SELinux checks to be bypassed for secretmem file descripto...

Affected product and versions

Product
Linux Linux, linux kernel, debian linux
Affected versions
>= 2bfe15c5261212130f1a71f32a300bcf426443d4 < 66d29d757c968d2bee9124816da5d718eb352959, >= 2bfe15c5261212130f1a71f32a300bcf426443d4 < e3eed01347721cd7a8819568161c91d538fbf229, >= 2bfe15c5261212130f1a71f32a300bcf426443d4 < f94c422157f3e43dd31990567b3e5d54b3e5b32b, >= 2bfe15c5261212130f1a71f32a300bcf426443d4 < 6ca45ea48530332a4ba09595767bd26d3232743b, >= 2bfe15c5261212130f1a71f32a300bcf426443d4 < cbe4134ea4bc493239786220bd69cb8a13493190, >= 6.0, >= 6.0 < 6.1.146, >= 6.2 < 6.6.97, >= 6.7 < 6.12.37, >= 6.13 < 6.15.6, 6.16, 11.0
Fixed versions
6.1.146, 6.6.97, 6.12.37, 6.15.6

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel, debian linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available