Description
In the Linux kernel, the following vulnerability has been resolved: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock ... or we risk stealing final mntput from sync umount - raising mnt_count after umount(2) has verified that victim is not busy, but before it has set MNT_SYNC_UMOUNT; in that case __legitimize_mnt() doesn't see that it's safe to quietly undo mnt_count increment and leaves dropping the reference to caller, where it'll be a full-blown mntput(). Check under mount_lock is needed; leaving the current one done before taking that makes no sense - it's nowhere near common enough to bother with.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
48a066e72d970a3e225a9c18690d570c736fc455 to < 628fb00195ce21a90cf9e4e3d105cd9e58f77b40affected48a066e72d970a3e225a9c18690d570c736fc455 to < b89eb56a378b7b2c1176787fc228d0a57172bdd5affected48a066e72d970a3e225a9c18690d570c736fc455 to < f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42affected48a066e72d970a3e225a9c18690d570c736fc455 to < 9b0915e72b3cf52474dcee0b24a2f99d93e604a3affected48a066e72d970a3e225a9c18690d570c736fc455 to < d8ece4ced3b051e656c77180df2e69e19e24edc1affected48a066e72d970a3e225a9c18690d570c736fc455 to < 8cafd7266fa02e0863bacbf872fe635c0b9725ebaffected48a066e72d970a3e225a9c18690d570c736fc455 to < b55996939c71a3e1a38f3cdc6a8859797efc9083affected48a066e72d970a3e225a9c18690d570c736fc455 to < 250cf3693060a5f803c5f1ddc082bb06b16112a9affected
Linux Linux
Default version status: affected
3.13affected0 to < 3.13unaffected5.4.294 to ≤ 5.4.*unaffected5.10.238 to ≤ 5.10.*unaffected5.15.185 to ≤ 5.15.*unaffected6.1.141 to ≤ 6.1.*unaffected6.6.93 to ≤ 6.6.*unaffected6.12.31 to ≤ 6.12.*unaffected6.14.9 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/628fb00195ce21a90cf9e4e3d105cd9e58f77b40 ↗
- https://git.kernel.org/stable/c/b89eb56a378b7b2c1176787fc228d0a57172bdd5 ↗
- https://git.kernel.org/stable/c/f6d45fd92f62845cbd1eb5128fd8f0ed7d0c5a42 ↗
- https://git.kernel.org/stable/c/9b0915e72b3cf52474dcee0b24a2f99d93e604a3 ↗
- https://git.kernel.org/stable/c/d8ece4ced3b051e656c77180df2e69e19e24edc1 ↗
- https://git.kernel.org/stable/c/8cafd7266fa02e0863bacbf872fe635c0b9725eb ↗
- https://git.kernel.org/stable/c/b55996939c71a3e1a38f3cdc6a8859797efc9083 ↗
- https://git.kernel.org/stable/c/250cf3693060a5f803c5f1ddc082bb06b16112a9 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗