Executive brief
A security flaw was identified in the Linux kernel's handling of private mount points, which are used to manage how files and folders are visible to different parts of the system. An attacker with local access could potentially bypass security restrictions to view or modify sensitive data that should have remained hidden. This could lead to a full system compromise or unauthorized access to protected information.
Technical details
A vulnerability exists in the Linux kernel's clone_private_mnt() function due to missing capability checks within the appropriate user namespace. Specifically, the function failed to verify if a caller possessed CAP_SYS_ADMIN rights in the user namespace associated with the mount's namespace. This oversight could allow a local attacker to clone a mount and potentially expose files or directories that were intended to be hidden or 'locked' by the system. The fix introduces a mandatory ns_capable check for CAP_SYS_ADMIN before allowing the private mount clone to proceed. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 427215d85e8d to 36fecd740de2d542d2091d65d36554ee2bcf9c65
- Linux Linux Kernel 427215d85e8d to d717325b5ecf2a40daca85c61923e17f32306179
- Linux Linux Kernel 427215d85e8d to dc6a664089f10eab0fb36b6e4f705022210191d2
- Linux Linux Kernel 427215d85e8d to e77078e52fbf018ab986efb3c79065ab35025607
- Linux Linux Kernel 427215d85e8d to 38628ae06e2a37770cd794802a3f1310cf9846e3
- Linux Linux Kernel 427215d85e8d to c28f922c9dcee0e4876a2c095939d77fe7e15116
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Timeline
- 2025-08-11: disclosed
- 2025-06-07: patched: Initial patch commit c28f922c9dcee0e4876a2c095939d77fe7e15116
References
- https://git.kernel.org/stable/c/36fecd740de2d542d2091d65d36554ee2bcf9c65
- https://git.kernel.org/stable/c/38628ae06e2a37770cd794802a3f1310cf9846e3
- https://git.kernel.org/stable/c/c28f922c9dcee0e4876a2c095939d77fe7e15116
- https://git.kernel.org/stable/c/d717325b5ecf2a40daca85c61923e17f32306179
- https://git.kernel.org/stable/c/dc6a664089f10eab0fb36b6e4f705022210191d2
- https://git.kernel.org/stable/c/e77078e52fbf018ab986efb3c79065ab35025607
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html