{"id":"CVE-2025-38498","title":"do_change_type(): refuse to operate on unmounted/not ours mounts","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndo_change_type(): refuse to operate on unmounted/not ours mounts\n\nEnsure that propagation settings can only be changed for mounts located\nin the caller's mount namespac…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 787937c4e373f1722c4343e5a5a4eb0f8543e589","Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < c7d11fdf8e5db5f34a6c062c7e6ba3a0971879d2","Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 432a171d60056489270c462e651e6c3a13f855b1","Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 064014f7812744451d5d0592f3d2bcd727f2ee93","Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 4f091ad0862b02dc42a19a120b7048de848561f8","Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 9c1ddfeb662b668fff69c5f1cfdd9f5d23d55d23","Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 19554c79a2095ddde850906a067915c1ef3a4114","Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 12f147ddd6de7382dad54812e65f3f08d05809fc","Linux 2.6.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-10T20:40:25.674803Z"},"published":"2025-07-30","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:07:27.398Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38498","references":[{"url":"https://git.kernel.org/stable/c/787937c4e373f1722c4343e5a5a4eb0f8543e589"},{"url":"https://git.kernel.org/stable/c/c7d11fdf8e5db5f34a6c062c7e6ba3a0971879d2"},{"url":"https://git.kernel.org/stable/c/432a171d60056489270c462e651e6c3a13f855b1"},{"url":"https://git.kernel.org/stable/c/064014f7812744451d5d0592f3d2bcd727f2ee93"},{"url":"https://git.kernel.org/stable/c/4f091ad0862b02dc42a19a120b7048de848561f8"},{"url":"https://git.kernel.org/stable/c/9c1ddfeb662b668fff69c5f1cfdd9f5d23d55d23"},{"url":"https://git.kernel.org/stable/c/19554c79a2095ddde850906a067915c1ef3a4114"},{"url":"https://git.kernel.org/stable/c/12f147ddd6de7382dad54812e65f3f08d05809fc"}],"tags":["cve.org"],"epss":0.00191,"epssPercentile":0.08652,"ingestedAt":"2026-10-15T05:52:46.086Z","slug":"CVE-2025-38498","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndo_change_type(): refuse to operate on unmounted/not ours mounts\n\nEnsure that propagation settings can only be changed for mounts located\nin the caller's mount namespace. This change aligns permission checking\nwith the rest of mount(2).\n\n## Affected\n\n- `Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 787937c4e373f1722c4343e5a5a4eb0f8543e589`\n- `Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < c7d11fdf8e5db5f34a6c062c7e6ba3a0971879d2`\n- `Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 432a171d60056489270c462e651e6c3a13f855b1`\n- `Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 064014f7812744451d5d0592f3d2bcd727f2ee93`\n- `Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 4f091ad0862b02dc42a19a120b7048de848561f8`\n- `Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 9c1ddfeb662b668fff69c5f1cfdd9f5d23d55d23`\n- `Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 19554c79a2095ddde850906a067915c1ef3a4114`\n- `Linux >= 07b20889e3052c7e77d6a6a54e7e83446eb1ba84 < 12f147ddd6de7382dad54812e65f3f08d05809fc`\n- `Linux 2.6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}