CVE-2025-38396

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass<br /> <br /> Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create<br /> anonymous inodes with proper security context. This replaces the current<br /> pattern of calling alloc_anon_inode() followed by<br /> inode_init_security_anon() for creating security context manually.<br /> <br /> This change also fixes a security regression in secretmem where the<br /> S_PRIVATE flag was not cleared after alloc_anon_inode(), causing<br /> LSM/SELinux checks to be bypassed for secretmem file descriptors.<br /> <br /> As guest_memfd currently resides in the KVM module, we need to export this<br /> symbol for use outside the core kernel. In the future, guest_memfd might be<br /> moved to core-mm, at which point the symbols no longer would have to be<br /> exported. When/if that happens is still unclear.