CVE-2025-38058: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38058 is a vulnerability discovered in the Linux kernel, disclosed on June 18, 2025. The vulnerability affects the mount functionality, specifically in the _legitimizemnt() function's handling of MNTSYNCUMOUNT checks (NVD, Debian Tracker).

The vulnerability occurs in the legitimizemnt() function where the check for MNTSYNCUMOUNT should be under mountlock. The issue manifests when raising mntcount after umount(2) has verified that the victim is not busy but before setting MNTSYNC_UMOUNT. In this scenario, legitimizemnt() fails to recognize when it's safe to quietly undo the mntcount increment, instead leaving the reference dropping to the caller where it becomes a full-blown mntput() (NVD).

The vulnerability affects multiple Linux distributions including Debian bullseye (versions 5.10.223-1 and 5.10.237-1), bookworm (versions 6.1.137-1 and 6.1.140-1), and trixie versions prior to 6.12.32-1 (Debian Tracker).

The vulnerability has been fixed in Linux kernel version 6.12.32-1 for Debian sid and trixie distributions. Users are advised to upgrade to this or later versions to address the vulnerability (Debian Tracker).