What is the CVSS score of CVE-2025-38411?

CVE-2025-38411 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2025-38411?

CVE-2025-38411 is a kernel-level local privilege escalation vulnerability in Linux netfs affecting development kernel versions 6.16-rc1 through 6.16-rc4.. A patch is available.

How to fix or mitigate CVE-2025-38411?

Within 24 hours, identify and inventory all systems running Linux kernel versions 6.16-rc1 through 6.16-rc4 across development, testing, and laboratory environments; document business justification for any prerelease kernel deployment. Within 7 days, apply the vendor-released patch to all affected systems and perform kernel version verification to confirm successful remediation. Within 30 days, conduct post-patch forensic review of affected systems to identify any signs of exploitation during the exposure window and decommission any development kernel instances no longer operationally necessary.

Linux Kernel CVE-2025-38411

HIGH

Double Free (CWE-415)

2025-07-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local low-priv access driving netfs I/O; the completion-during-pause double-free is a timing race, so AC:H, with full kernel-memory C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:23 vuln.today

CVE Published

Jul 25, 2025 - 14:15 nvd

HIGH 7.8

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix double put of request

If a netfs request finishes during the pause loop, it will have the ref that belongs to the IN_PROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will *also* put the ref because it sees that the IN_PROGRESS flag is clear and incorrectly assumes that this happened when it called the collector.

In fact, since IN_PROGRESS is clear, we shouldn't call the collector again since it's done all the cleanup, such as calling ->ki_complete().

Fix this by making netfs_collect_in_app() just return, indicating that we're done if IN_PROGRESS is removed.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's netfs (network filesystem) subsystem affects development builds 6.16-rc1 through 6.16-rc4, where a reference-counting error causes a double put of a netfs request. When a netfs request completes during the pause loop, the reference tied to the IN_PROGRESS flag is dropped, but the subsequent final wait loop erroneously drops it again, leading to a use-after-free/double-free condition (CWE-415). CVSS is 7.8 (High) requiring low-privileged local access; EPSS is low at 0.15% and there is no public exploit identified at time of analysis.

Technical ContextAI

The flaw lives in the Linux kernel's netfs library, the shared helper layer that backs network and caching filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p, NFS via fscache) by managing asynchronous read/write requests and their lifecycle. Each netfs_io_request is reference-counted, and one reference is conceptually owned by the NETFS_RQ_IN_PROGRESS flag. The bug is a classic CWE-415 double-free/double-put: netfs_collect_in_app() and the final wait loop both release the IN_PROGRESS reference when a request completes mid-pause, because the wait loop misinterprets a cleared IN_PROGRESS flag as work it must finalize (including invoking ->ki_complete()) when in fact the collector already performed that cleanup. The fix makes netfs_collect_in_app() simply return when IN_PROGRESS has already been cleared, avoiding the duplicate reference drop and duplicate completion call.

RemediationAI

Patch available per vendor advisory - the upstream fix corrects netfs_collect_in_app() to return early when the IN_PROGRESS flag is already cleared, preventing the double put; apply the commits at https://git.kernel.org/stable/c/9df7b5ebead649b00bf9a53a798e4bf83a1318fd and https://git.kernel.org/stable/c/d18facba5a5795ad44b2a00a052e3db2fa77ab12, or upgrade to a 6.16 build (final release or later RC) that incorporates them. Since exposure is limited to 6.16 release candidates, the cleanest remediation is to move off the affected RC kernels onto a fixed build rather than run mitigations; if you must remain on an affected RC, reduce attack surface by limiting local user access and avoiding workloads that exercise netfs-backed filesystems (AFS, Ceph, CIFS/SMB, 9p, fscache-backed mounts), accepting that disabling those filesystems removes the functionality they provide. No exact tagged fix version number is provided in the input beyond the referenced commits.

Same weakness CWE-415 – Double Free

View all

CVE-2014-0502 HIGH POC

8.8

CVE-2018-0101 CRITICAL POC

10.0

CVE-2023-25136 MEDIUM POC

6.5

CVE-2026-33824 CRITICAL POC

9.8

CVE-2014-1767 HIGH POC

7.2

CVE-2016-5768 CRITICAL POC

9.8

CVE-2016-5772 CRITICAL POC

9.8

CVE-2016-3132 CRITICAL POC

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected

CVE-2025-38411 vulnerability details – vuln.today

Back

Linux Kernel CVE-2025-38411

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-415 – Double Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code