{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-38499",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-38499",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-08-11T16:01:08.257Z",
    "updatedAt": "2026-10-15T21:52:17.524Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nclone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns\n\nWhat we want is to verify there is that clone won't expose something\nhidden by a mount we wouldn't be able to undo.  \"Wouldn't be able to undo\"\nmay be a result of MNT_LOCKED on a child, but it may also come from\nlacking admin rights in the userns of the namespace mount belongs to.\n\nclone_private_mnt() checks the former, but not the latter.\n\nThere's a number of rather confusing CAP_SYS_ADMIN checks in various\nuserns during the mount, especially with the new mount API; they serve\ndifferent purposes and in case of clone_private_mnt() they usually,\nbut not always end up covering the missing check mentioned above.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "status": "affected",
              "versionType": "git",
              "lessThan": "36fecd740de2d542d2091d65d36554ee2bcf9c65"
            },
            {
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "status": "affected",
              "versionType": "git",
              "lessThan": "d717325b5ecf2a40daca85c61923e17f32306179"
            },
            {
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "status": "affected",
              "versionType": "git",
              "lessThan": "dc6a664089f10eab0fb36b6e4f705022210191d2"
            },
            {
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "status": "affected",
              "versionType": "git",
              "lessThan": "e77078e52fbf018ab986efb3c79065ab35025607"
            },
            {
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "status": "affected",
              "versionType": "git",
              "lessThan": "38628ae06e2a37770cd794802a3f1310cf9846e3"
            },
            {
              "version": "427215d85e8d1476da1a86b8d67aceb485eb3631",
              "status": "affected",
              "versionType": "git",
              "lessThan": "c28f922c9dcee0e4876a2c095939d77fe7e15116"
            },
            {
              "version": "c6e8810d25295acb40a7b69ed3962ff181919571",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "e3eee87c846dc47f6d8eb6d85e7271f24122a279",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "517b875dfbf58f0c6c9e32dc90f5cf42d71a42ce",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "963d85d630dabe75a3cfde44a006fec3304d07b8",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "812f39ed5b0b7f34868736de3055c92c7c4cf459",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "6a002d48a66076524f67098132538bef17e8445e",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "41812f4b84484530057513478c6770590347dc30",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "4.4.281",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.5"
            },
            {
              "version": "4.9.280",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.10"
            },
            {
              "version": "4.14.244",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.15"
            },
            {
              "version": "4.19.204",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.20"
            },
            {
              "version": "5.4.141",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.5"
            },
            {
              "version": "5.10.59",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.11"
            },
            {
              "version": "5.13.11",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.14"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.14",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.14"
            },
            {
              "version": "5.15.190",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.147",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.100",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.40",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.15.3",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.15.*"
            },
            {
              "version": "6.16",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}