Linux aws: In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns… (CVE-2025-38499)
In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above.
AI Analysis
Technical Summary
The advisory covers three kernel vulnerabilities: CVE-2025-38499 fixes clone_private_mnt() to ensure the caller has CAP_SYS_ADMIN in the correct user namespace, preventing privilege escalation (CWE-266). CVE-2025-39966 addresses a race condition in the iommufd subsystem during file descriptor aborts (CWE-416). CVE-2025-40176 resolves an issue in the TLS code where pending asynchronous decryptions were not properly awaited if tls_strp_msg_hold failed, potentially causing use-after-free or memory corruption (CWE-825). Red Hat has released updated kernel packages for Red Hat Enterprise Linux 9 and related variants to remediate these vulnerabilities.
Potential Impact
These vulnerabilities affect the Linux kernel core, potentially allowing unauthorized privilege escalation, race condition exploitation, or memory corruption. Exploitation could compromise system stability or security. Red Hat rates the overall impact as important, indicating significant security concerns but not critical. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released official kernel updates that address these vulnerabilities. Users should apply the updated kernel packages for Red Hat Enterprise Linux 9 as provided in advisory RHSA-2025:23241. A system reboot is required to complete the update process. No additional mitigations are indicated beyond applying the official patches.
Linux aws: In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns… (CVE-2025-38499)
Description
In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above.
CVSS v3.1
Score 7.8high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The advisory covers three kernel vulnerabilities: CVE-2025-38499 fixes clone_private_mnt() to ensure the caller has CAP_SYS_ADMIN in the correct user namespace, preventing privilege escalation (CWE-266). CVE-2025-39966 addresses a race condition in the iommufd subsystem during file descriptor aborts (CWE-416). CVE-2025-40176 resolves an issue in the TLS code where pending asynchronous decryptions were not properly awaited if tls_strp_msg_hold failed, potentially causing use-after-free or memory corruption (CWE-825). Red Hat has released updated kernel packages for Red Hat Enterprise Linux 9 and related variants to remediate these vulnerabilities.
Potential Impact
These vulnerabilities affect the Linux kernel core, potentially allowing unauthorized privilege escalation, race condition exploitation, or memory corruption. Exploitation could compromise system stability or security. Red Hat rates the overall impact as important, indicating significant security concerns but not critical. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released official kernel updates that address these vulnerabilities. Users should apply the updated kernel packages for Red Hat Enterprise Linux 9 as provided in advisory RHSA-2025:23241. A system reboot is required to complete the update process. No additional mitigations are indicated beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:23241
- Cve Count
- 3
- Additional Cves
- ["CVE-2025-39966","CVE-2025-40176"]
Threat ID: 6a3da1d84853345fc182838a
Added to database: 06/25/2026, 21:47:04 UTC
Last enriched: 06/25/2026, 22:18:25 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.