CVE-2025-38653

proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al

Description

In the Linux kernel, the following vulnerability has been resolved: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after commit 654b33ada4ab("proc: fix UAF in proc_get_inode()"). Followed by AI Viro's suggestion, fix it in same manner.

N/A

CVSS

Severity:

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/c35b0feb80b48720dfbbf4e33759c7be3faaebb6
https://git.kernel.org/stable/c/33c778ea0bd0fa62ff590497e72562ff90f82b13
https://git.kernel.org/stable/c/fc1072d934f687e1221d685cf1a49a5068318f34
https://git.kernel.org/stable/c/d136502e04d8853a9aecb335d07bbefd7a1519a8
https://git.kernel.org/stable/c/1fccbfbae1dd36198dc47feac696563244ad81d3
https://git.kernel.org/stable/c/ff7ec8dc1b646296f8d94c39339e8d3833d16c05

Frequently Asked Questions

What is the severity of CVE-2025-38653?: CVE-2025-38653 has not yet been assigned a CVSS score.
How to fix CVE-2025-38653?: To fix CVE-2025-38653, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-38653 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-38653 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-38653?: CVE-2025-38653 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.