Answer in brief
CVE-2025-38499 records a Unknown severity vulnerability in clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=427215d85e8d1476da1a86b8d67aceb485eb3631 <36fecd740de2d542d2091d65d36554ee2bcf9c65 || >=427215d85e8d1476da1a86b8d67aceb485eb3631 <d717325b5ecf2a40daca85c61923e17f32306179 || >=427215d85e8d1476da1a86b8d67aceb485eb3631 <dc6a664089f10eab0fb36b6e4f705022210191d2 || >=427215d85e8d1476da1a86b8d67aceb485eb3631 <e77078e52fbf018ab986efb3c79065ab35025607 || >=427215d85e8d1476da1a86b8d67aceb485eb3631 <38628ae06e2a37770cd794802a3f1310cf9846e3 || >=427215d85e8d1476da1a86b8d67aceb485eb3631 <c28f922c9dcee0e4876a2c095939d77fe7e15116 || c6e8810d25295acb40a7b69ed3962ff181919571 || e3eee87c846dc47f6d8eb6d85e7271f24122a279 || 517b875dfbf58f0c6c9e32dc90f5cf42d71a42ce || 963d85d630dabe75a3cfde44a006fec3304d07b8 || 812f39ed5b0b7f34868736de3055c92c7c4cf459 || 6a002d48a66076524f67098132538bef17e8445e || 41812f4b84484530057513478c6770590347dc30 || >=4.4.281 <4.5 || >=4.9.280 <4.10 || >=4.14.244 <4.15 || >=4.19.204 <4.20 || >=5.4.141 <5.5 || >=5.10.59 <5.11 || >=5.13.11 <5.14 | 36fecd740de2d542d2091d65d36554ee2bcf9c65, d717325b5ecf2a40daca85c61923e17f32306179, dc6a664089f10eab0fb36b6e4f705022210191d2, e77078e52fbf018ab986efb3c79065ab35025607, 38628ae06e2a37770cd794802a3f1310cf9846e3, c28f922c9dcee0e4876a2c095939d77fe7e15116, 4.5, 4.10, 4.15, 4.20, 5.5, 5.11, 5.14 |
| Linux/Linuxgeneric | 5.14 | Not reported |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
Published upstream
Aug 11, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above.
Quoted source text, attributed separately from HOL analysis.