NACK/Cmnt: [SRU][N][PATCH 0/1] CVE-2025-38498

[Edoardo Canepa]

Rejected for the following reasons:
12f147ddd6de has a Fixes: commit,
cffd0441872e use uniform permission checks for all mount propagation 
changes
and shipping the first half alone brings its known userland
regression into noble: check_mnt() rejects propagation changes on any
mount outside the caller's own namespace even when the caller already
has CAP_SYS_ADMIN in that namespace's userns, which is what CRIU and
similar checkpoint/restore tooling does, and which do_set_group()
already permits for the same graph.

On 9/11/26 07:10, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-38498
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> do_change_type(): refuse to operate on unmounted/not ours mounts
>
> Ensure that propagation settings can only be changed for mounts located in the
> caller's mount namespace. This change aligns permission checking with the rest
> of mount(2).
>
> [ Fix ]
>
> noble/linux: clean cherry-pick of 12f147ddd6de
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> The fix adds a namespace ownership check inside do_change_type(), the code
> path exercised by mount(2) when changing mount propagation
> (MS_SHARED/MS_PRIVATE/MS_SLAVE/MS_UNBINDABLE). A bad fix could reject
> legitimate propagation changes and break workloads that reconfigure mount
> propagation, such as container runtimes, systemd unit setup and
> namespace-heavy tooling that manipulates mounts within their own mount
> namespace. This is not tied to any particular hardware or architecture.
> Systems that never change mount propagation, and mounts already owned by the
> caller's mount namespace, are not affected.
>
> [ Other Info ]
>
> Kybele flow-v11-25-ga27c0fa6. Reference: ab23f1a1/v1
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260916/b1aec372/attachment.sig>