---
id: CVE-2025-38282
title: 'kernfs: Relax constraint in draining guard'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  kernfs: Relax constraint in draining guard

  The active reference lifecycle provides the break/unbreak mechanism but
  the active reference is not truly active after unbre…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 <
    2d6a67c2b3b87808a347dc1047b520a9dd177a4f
  - >-
    Linux >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 <
    6c81f1c7812c61f187bed1b938f1d2e391d503ab
  - >-
    Linux >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 <
    6bfb154f95d5f0ab7ed056f23aba8c1a94cb3927
  - >-
    Linux >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 <
    72275c888f8962b406ee9c6885c79bf68cca5a63
  - >-
    Linux >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 <
    071d8e4c2a3b0999a9b822e2eb8854784a350f8a
  - Linux 6.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:53:01.163475Z'
published: '2025-07-10'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:02:30.419Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-38282'
references:
  - url: 'https://git.kernel.org/stable/c/2d6a67c2b3b87808a347dc1047b520a9dd177a4f'
  - url: 'https://git.kernel.org/stable/c/6c81f1c7812c61f187bed1b938f1d2e391d503ab'
  - url: 'https://git.kernel.org/stable/c/6bfb154f95d5f0ab7ed056f23aba8c1a94cb3927'
  - url: 'https://git.kernel.org/stable/c/72275c888f8962b406ee9c6885c79bf68cca5a63'
  - url: 'https://git.kernel.org/stable/c/071d8e4c2a3b0999a9b822e2eb8854784a350f8a'
tags:
  - cve.org
epss: 0.00191
epssPercentile: 0.08763
ingestedAt: '2026-11-05T22:38:31.946Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

kernfs: Relax constraint in draining guard

The active reference lifecycle provides the break/unbreak mechanism but
the active reference is not truly active after unbreak -- callers don't
use it afterwards but it's important for proper pairing of kn->active
counting. Assuming this mechanism is in place, the WARN check in
kernfs_should_drain_open_files() is too sensitive -- it may transiently
catch those (rightful) callers between
kernfs_unbreak_active_protection() and kernfs_put_active() as found out by Chen
Ridong:

	kernfs_remove_by_name_ns	kernfs_get_active // active=1
	__kernfs_remove					  // active=0x80000002
	kernfs_drain			...
	wait_event
	//waiting (active == 0x80000001)
					kernfs_break_active_protection
					// active = 0x80000001
	// continue
					kernfs_unbreak_active_protection
					// active = 0x80000002
	...
	kernfs_should_drain_open_files
	// warning occurs
					kernfs_put_active

To avoid the false positives (mind panic_on_warn) remove the check altogether.
(This is meant as quick fix, I think active reference break/unbreak may be
simplified with larger rework.)

## Affected

- `Linux >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 < 2d6a67c2b3b87808a347dc1047b520a9dd177a4f`
- `Linux >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 < 6c81f1c7812c61f187bed1b938f1d2e391d503ab`
- `Linux >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 < 6bfb154f95d5f0ab7ed056f23aba8c1a94cb3927`
- `Linux >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 < 72275c888f8962b406ee9c6885c79bf68cca5a63`
- `Linux >= bdb2fd7fc56e197a63c0b0e7e07d25d5e20e7c72 < 071d8e4c2a3b0999a9b822e2eb8854784a350f8a`
- `Linux 6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.