CVE-2025-40203: Linux

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: listmount: don't call path_put() under namespace semaphore Massage listmount() and make sure we don't call path_put() under the namespace semaphore. If we put the last reference we're fscked.

Affected products

• Linux Linux: from 6.8, before 6.12.54 (fixed in 6.12.54); from 6.13, before 6.17.4 (fixed in 6.17.4)

Published 2025-11-12. Last modified 2026-07-30.