{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2025-40072", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-40072", "idYear": 2025, "status": "PUBLISHED", "publishedAt": "2025-10-28T11:48:39.999Z", "updatedAt": "2026-05-11T21:41:56.450Z", "importedAt": "2026-10-24T01:57:34.152Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing\n\nThe function do_fanotify_mark() does not validate if\nmnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns.\nThis causes a NULL pointer dereference in do_fanotify_mark() if the\npath is not a mount namespace object.\n\nFix this by checking mnt_ns_from_dentry()'s return value before\ndereferencing it.\n\nBefore the patch\n\n$ gcc fanotify_nullptr.c -o fanotify_nullptr\n$ mkdir A\n$ ./fanotify_nullptr\nFanotify fd: 3\nfanotify_mark: Operation not permitted\n$ unshare -Urm\nFanotify fd: 3\nKilled\n\nint main(void){\n int ffd;\n ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);\n if(ffd < 0){\n perror(\"fanotify_init\");\n exit(EXIT_FAILURE);\n }\n\n printf(\"Fanotify fd: %d\\n\",ffd);\n\n if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS,\nFAN_MNT_ATTACH, AT_FDCWD, \"A\") < 0){\n perror(\"fanotify_mark\");\n exit(EXIT_FAILURE);\n }\n\nreturn 0;\n}\n\nAfter the patch\n\n$ gcc fanotify_nullptr.c -o fanotify_nullptr\n$ mkdir A\n$ ./fanotify_nullptr\nFanotify fd: 3\nfanotify_mark: Operation not permitted\n$ unshare -Urm\nFanotify fd: 3\nfanotify_mark: Invalid argument\n\n[ 25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038\n[ 25.695006] #PF: supervisor read access in kernel mode\n[ 25.695012] #PF: error_code(0x0000) - not-present page\n[ 25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0\n[ 25.695025] Oops: Oops: 0000 [#1] SMP NOPTI\n[ 25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not\ntainted 6.17.0-rc4 #1 PREEMPT(lazy)\n[ 25.695040] Hardware name: VMware, Inc. VMware Virtual\nPlatform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\n[ 25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950\n[ 25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54\n24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b\n5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28\n85 c9\n[ 25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203\n[ 25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220\n[ 25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180\n[ 25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000\n[ 25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7\n[ 25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0\n[ 25.695154] FS: 00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000)\nknlGS:0000000000000000\n[ 25.695162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0\n[ 25.695201] Call Trace:\n[ 25.695209] \n[ 25.695215] __x64_sys_fanotify_mark+0x1f/0x30\n[ 25.695222] do_syscall_64+0x82/0x2c0\n...", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "58f5fbeb367ff6f30a2448b2cad70f70b2de4b06", "status": "affected", "versionType": "git", "lessThan": "73ce2a774ad6497cbd48dc4f8a5d699bc417f3fa" }, { "version": "58f5fbeb367ff6f30a2448b2cad70f70b2de4b06", "status": "affected", "versionType": "git", "lessThan": "62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "6.16", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "6.16" }, { "version": "6.17.3", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.17.*" }, { "version": "6.18", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }