Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U H H H 7.8 .0033 26.0 —
AFFECTED Product Versions Fixed Linux 329ba1cb402ac328224965b8fc7a554a5150908e – — Linux 6.15.3 – —
TIMELINE Apr 16 Reserved by Linux Jul 25 Published (CNA: Linux) Jul 30 RESCORED — CVE-2025-38411 (Linux). CVSS 9.8 → 7.8 (NVD).
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix double put of request If a netfs request finishes during the pause loop, it will have the ref that belongs to the IN_PROGRESS flag removed at that point - however, if it then goes to the final wait loop, that will *also* put the ref because it sees that the IN_PROGRESS flag is clear and incorrectly assumes that this happened when it called the collector. In fact, since IN_PROGRESS is clear, we shouldn't call the collector again since it's done all the cleanup, such as calling ->ki_complete(). Fix this by making netfs_collect_in_app() just return, indicating that we're done if IN_PROGRESS is removed.
| Date | Event | Detail |
|---|---|---|
| April 16, 2025 | Reserved | Reserved by Linux |
| July 25, 2025 | Published | Published (CNA: Linux) |
| July 30, 2026 | RESCORED | RESCORED — CVE-2025-38411 (Linux). CVSS 9.8 → 7.8 (NVD). |
Authoritative record: CVE-2025-38411 at cve.org
Vendors: linux
Weaknesses: CWE-415
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-38411 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.