CVE-2025-38411
Severity CVSS v4.0:
Pending analysis
Type:
CWE-415
Double Free
Publication date:
25/07/2025
Last modified:
19/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
netfs: Fix double put of request<br />
<br />
If a netfs request finishes during the pause loop, it will have the ref<br />
that belongs to the IN_PROGRESS flag removed at that point - however, if it<br />
then goes to the final wait loop, that will *also* put the ref because it<br />
sees that the IN_PROGRESS flag is clear and incorrectly assumes that this<br />
happened when it called the collector.<br />
<br />
In fact, since IN_PROGRESS is clear, we shouldn&#39;t call the collector again<br />
since it&#39;s done all the cleanup, such as calling ->ki_complete().<br />
<br />
Fix this by making netfs_collect_in_app() just return, indicating that<br />
we&#39;re done if IN_PROGRESS is removed.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.15.3 (including) | 6.15.6 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.16:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.16:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.16:rc4:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page