SECUFOCUSNOW
Home›CVE index›CVE-2025-38411
Review reviewHigh

CVE-2025-38411

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix double put of request If a netfs request finishes during the pause loop, it will have the ref that belongs to the IN_PROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will *also* put the ref because it sees that the IN_PROGRESS flag is clear and incorrectly assumes that this happened when it called the collector. In fact, since IN_PROGRESS is clear, we shouldn't call the collector again since it's done all the cleanup, such as calling ->ki_complete(). Fix this by making n...

CVSS
7.8
EPSS
0.32%
24.7% percentile
CISA KEV
Not listed
Published
2025.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.32%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix double put of request If a netfs request finishes during the pause loop, it will have the ref that belongs to the IN_PROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will *also* put the ref because it sees that the IN_PROGRESS flag is clear and incorrectly assumes that this happened when it called the collector. In fact, since IN_PROGRESS is clear, we shouldn't call the collector again since it's done all the cleanup, such as calling ->ki_complete(). Fix this by making n...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 329ba1cb402ac328224965b8fc7a554a5150908e < d18facba5a5795ad44b2a00a052e3db2fa77ab12, >= 2b1424cd131cfaba4cf7040473133d26cddac088 < 9df7b5ebead649b00bf9a53a798e4bf83a1318fd, >= 6.15.3 < 6.15.6, 6.16
Fixed versions
6.15.6

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-415
CVE-2025-38411 — Linux Linux, linux kernel | SECUFOCUS NOW