Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export… (CVE-2025-38396)
In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon() for creating security context manually. This change also fixes a security regression in secretmem where the S_PRIVATE flag was not cleared after alloc_anon_inode(), causing LSM/SELinux checks to be bypassed for secretmem file descriptors. As guest_memfd currently resides in the KVM module, we need to export this symbol for use outside the core kernel. In the future, guest_memfd might be moved to core-mm, at which point the symbols no longer would have to be exported. When/if that happens is still unclear.
AI Analysis
Technical Summary
Red Hat issued a security advisory (RHSA-2025:16904) for the Linux kernel packages in Red Hat Enterprise Linux 10, addressing six distinct vulnerabilities: CVE-2025-38396 fixes a secretmem LSM bypass by exporting anon_inode_make_secure_inode(); CVE-2025-38527 resolves a use-after-free in the SMB client cifs_oplock_break; CVE-2025-38523 corrects the smbd_response slab to allow usercopy; CVE-2025-39682 fixes TLS handling of zero-length records on the rx_list; CVE-2025-39698 ensures proper cleanup in io_futex_wait on failure; and CVE-2025-39694 corrects the SCCB present check on s390/sclp. The advisory requires applying updated kernel packages and rebooting the system to activate the fixes. No CVSS scores are provided, but Red Hat rates the overall impact as moderate.
Potential Impact
The vulnerabilities affect critical kernel components, potentially allowing bypasses of security mechanisms (secretmem LSM), memory corruption (use-after-free), improper memory handling (usercopy), protocol handling errors (TLS zero-length records), improper cleanup in kernel futex operations, and incorrect hardware checks on s390 architecture. Exploitation could lead to system instability or privilege escalation. However, no known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released updated kernel packages that address these vulnerabilities. Users should apply the security update RHSA-2025:16904 for Red Hat Enterprise Linux 10 and reboot the system to ensure the fixes take effect. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export… (CVE-2025-38396)
Description
In the Linux kernel, the following vulnerability has been resolved: fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass Export anon_inode_make_secure_inode() to allow KVM guest_memfd to create anonymous inodes with proper security context. This replaces the current pattern of calling alloc_anon_inode() followed by inode_init_security_anon() for creating security context manually. This change also fixes a security regression in secretmem where the S_PRIVATE flag was not cleared after alloc_anon_inode(), causing LSM/SELinux checks to be bypassed for secretmem file descriptors. As guest_memfd currently resides in the KVM module, we need to export this symbol for use outside the core kernel. In the future, guest_memfd might be moved to core-mm, at which point the symbols no longer would have to be exported. When/if that happens is still unclear.
CVSS v3.1
Score 7.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat issued a security advisory (RHSA-2025:16904) for the Linux kernel packages in Red Hat Enterprise Linux 10, addressing six distinct vulnerabilities: CVE-2025-38396 fixes a secretmem LSM bypass by exporting anon_inode_make_secure_inode(); CVE-2025-38527 resolves a use-after-free in the SMB client cifs_oplock_break; CVE-2025-38523 corrects the smbd_response slab to allow usercopy; CVE-2025-39682 fixes TLS handling of zero-length records on the rx_list; CVE-2025-39698 ensures proper cleanup in io_futex_wait on failure; and CVE-2025-39694 corrects the SCCB present check on s390/sclp. The advisory requires applying updated kernel packages and rebooting the system to activate the fixes. No CVSS scores are provided, but Red Hat rates the overall impact as moderate.
Potential Impact
The vulnerabilities affect critical kernel components, potentially allowing bypasses of security mechanisms (secretmem LSM), memory corruption (use-after-free), improper memory handling (usercopy), protocol handling errors (TLS zero-length records), improper cleanup in kernel futex operations, and incorrect hardware checks on s390 architecture. Exploitation could lead to system instability or privilege escalation. However, no known exploits in the wild have been reported at this time.
Mitigation Recommendations
Red Hat has released updated kernel packages that address these vulnerabilities. Users should apply the security update RHSA-2025:16904 for Red Hat Enterprise Linux 10 and reboot the system to ensure the fixes take effect. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:16904
- Cve Count
- 6
- Additional Cves
- ["CVE-2025-38523","CVE-2025-38527","CVE-2025-39682","CVE-2025-39694","CVE-2025-39698"]
Threat ID: 6a3da1e24853345fc182c3d9
Added to database: 06/25/2026, 21:47:14 UTC
Last enriched: 06/25/2026, 22:29:39 UTC
Last updated: 09/10/2026, 19:24:56 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.