CVE-2025-38498

The vulnerability resides in the do_change_type() function in the Linux kernel, which is responsible for changing mount propagation flags (e.g., MS_SLAVE, MS_SHARED). The root cause is that the function did not verify whether the target mount belongs to the caller's mount namespace before applying the change, unlike other mount operations that enforce such checks.

An unprivileged local attacker could exploit this by invoking mount(2) with appropriate flags on a mount that does not belong to their namespace. This bypasses the intended namespace isolation, allowing the attacker to modify propagation settings of mounts owned by other namespaces.

Successful exploitation could enable an attacker to interfere with mount event propagation, potentially leading to denial of service or information disclosure across namespace boundaries. The CVSS v3 base score is 5.5 (Medium), reflecting the need for local access and the potential for limited impact.

The Linux kernel community addressed this issue in commits [3] and [4] by adding a check that ensures the mount is both mounted and belongs to the caller's namespace. Users should update to the latest stable kernel version containing these patches.