CVE-2025-38499: Linux Kernel missing CAP_SYS_ADMIN check in clone_private_mnt

CVE-2025-38499 · Severity: high · CVSS 7.8 · Published 2025-08-11

A security flaw was identified in the Linux kernel's handling of private mount points, which are used to manage how files and folders are visible to different parts of the system. An attacker with local access could potentially bypass security restrictions to view or modify sensitive data that should have remained hidden. This could lead to a full system compromise or unauthorized access to protected information.

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-38499 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-38499 being exploited in the wild.
How severe is CVE-2025-38499?
High severity, with a CVSS score of 7.8, published 11 August 2025.
Which products and versions are affected?
Linux Kernel 4.4.281 to 4.5; 4.9.280 to 4.10; 4.14.244 to 4.15; 4.19.204 to 4.20; 5.4.141 to 5.5; 5.10.59 to 5.11; 5.13.11 to 5.14; 5.14.1 to 5.15.190; 5.16 to 6.1.147; 6.2 to 6.6.100; 6.7 to 6.12.40; 6.13 to 6.15.3; Linux Kernel 427215d85e8d to 36fecd740de2d542d2091d65d36554ee2bcf9c65; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5; and 1 more.
Is there a fix for CVE-2025-38499?
A patch was published on 2025-06-07: Initial patch commit c28f922c9dcee0e4876a2c095939d77fe7e15116 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-38499 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2025-38499?
Check whether you run Linux Kernel, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Linux kernel's clone_private_mnt() function due to missing capability checks within the appropriate user namespace. Specifically, the function failed to verify if a caller possessed CAP_SYS_ADMIN rights in the user namespace associated with the mount's namespace. This oversight could allow a local attacker to clone a mount and potentially expose files or directories that were intended to be hidden or 'locked' by the system. The fix introduces a mandatory ns_capable check for CAP_SYS_ADMIN before allowing the private mount clone to proceed. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 427215d85e8d to 36fecd740de2d542d2091d65d36554ee2bcf9c65
  • Linux Linux Kernel 427215d85e8d to d717325b5ecf2a40daca85c61923e17f32306179
  • Linux Linux Kernel 427215d85e8d to dc6a664089f10eab0fb36b6e4f705022210191d2
  • Linux Linux Kernel 427215d85e8d to e77078e52fbf018ab986efb3c79065ab35025607
  • Linux Linux Kernel 427215d85e8d to 38628ae06e2a37770cd794802a3f1310cf9846e3
  • Linux Linux Kernel 427215d85e8d to c28f922c9dcee0e4876a2c095939d77fe7e15116
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5

Timeline

  • 2025-08-11: disclosed
  • 2025-06-07: patched: Initial patch commit c28f922c9dcee0e4876a2c095939d77fe7e15116

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.