[SRU][N][PATCH 0/1] CVE-2025-38498

[Cengiz Can]

https://ubuntu.com/security/CVE-2025-38498

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

do_change_type(): refuse to operate on unmounted/not ours mounts

Ensure that propagation settings can only be changed for mounts located in the
caller's mount namespace. This change aligns permission checking with the rest
of mount(2).

[ Fix ]

noble/linux: clean cherry-pick of 12f147ddd6de

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

The fix adds a namespace ownership check inside do_change_type(), the code
path exercised by mount(2) when changing mount propagation
(MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE). A bad fix could reject
legitimate propagation changes and break workloads that reconfigure mount
propagation, such as container runtimes, systemd unit setup and
namespace-heavy tooling that manipulates mounts within their own mount
namespace. This is not tied to any particular hardware or architecture.
Systems that never change mount propagation, and mounts already owned by the
caller's mount namespace, are not affected.

[ Other Info ]

Kybele flow-v11-25-ga27c0fa6. Reference: ab23f1a1/v1