Linux Kernel Netfs Vulnerability Affecting Linux Systems

CVE-2025-38411

What is CVE-2025-38411?

A vulnerability in the Linux kernel's netfs subsystem could lead to improper reference counting during the lifecycle of netfs requests. Specifically, if a netfs request is completed during a pause loop, it mistakenly assumes the cleanup for that request is handled. This can lead to double decrementing of reference counts, potentially causing undefined behavior or stability issues. The issue has been addressed by modifying the behavior of netfs_collect_in_app() to correctly handle the IN_PROGRESS flag, ensuring proper cleanup and lifecycle management of requests.

References