CVE-2025-38357: Linux Kernel Privilege Escalation Flaw

CVE-2025-38357 Overview

CVE-2025-38357 is a Linux kernel vulnerability affecting the Filesystem in Userspace (FUSE) subsystem. The flaw triggers a runtime warning in truncate_folio_batch_exceptionals() because FUSE did not remove all Direct Access (DAX) entries before invoking the truncation path. Similar fixes were previously applied to XFS and ext4 through commit 0e2f80afcfa6 ("fs/dax: ensure all pages are idle prior to filesystem unmount"), but the FUSE filesystem was missed. The issue affects Linux kernel versions 6.16-rc1 through 6.16-rc3. Exploitation requires local access with low privileges and can impact system availability and integrity through the kernel warning path.

Critical Impact
A local, low-privileged user interacting with a FUSE-mounted filesystem can trigger a kernel WARN_ON_ONCE condition, resulting in kernel log pollution and potential impact on filesystem operations during inode eviction.

Affected Products

Linux Kernel 6.16-rc1
Linux Kernel 6.16-rc2
Linux Kernel 6.16-rc3

Discovery Timeline

2025-07-25 - CVE CVE-2025-38357 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38357

Vulnerability Analysis

The vulnerability resides in the FUSE filesystem implementation within the Linux kernel [CWE-noinfo]. The truncate_folio_batch_exceptionals() function at mm/truncate.c:89 contains a WARN_ON_ONCE guard designed to capture cases where a filesystem has not removed all DAX entries before truncation. When FUSE evicts an inode via fuse_evict_inode(), the code path reaches truncate_inode_pages_range() and subsequently truncate_folio_batch_exceptionals() without clearing outstanding DAX exceptional entries.

The result is a kernel warning generated during routine filesystem operations such as closing a file descriptor. The call trace shows the syscall entry through __x64_sys_close reaching __fput, dput, __dentry_kill, evict, and finally fuse_evict_inode. While the warning itself is informational, the underlying inconsistency in DAX entry handling can affect filesystem state integrity.

Root Cause

The root cause is a missing synchronization step in the FUSE filesystem code that ensures all DAX entries are idle prior to unmount or inode eviction. This fix was applied to XFS and ext4 in commit 0e2f80afcfa6 but was not propagated to FUSE, leaving FUSE inodes with residual DAX exceptional entries when truncate_inode_pages_range() executes.

Attack Vector

Exploitation requires local access with low privileges. An attacker with the ability to interact with a FUSE-mounted filesystem can trigger repeated inode eviction operations that generate kernel warnings. Because the attack vector is local (AV:L) and requires low privileges (PR:L), it is generally limited to authenticated local users or processes with FUSE mount capabilities. The vulnerability does not require user interaction. The kernel warning path is triggered through standard filesystem syscalls such as close() against files on a FUSE mount configured with DAX.

No public proof-of-concept exploit code is available for this vulnerability. Refer to the Kernel Git Commit Details for the technical fix.

Detection Methods for CVE-2025-38357

Indicators of Compromise

Kernel log entries containing WARNING: CPU: ... at mm/truncate.c:89 truncate_folio_batch_exceptionals
Call trace entries referencing fuse_evict_inode following truncate_inode_pages_range
Repeated WARN_ON_ONCE messages during FUSE filesystem operations involving DAX-mapped files

Detection Strategies

Monitor /var/log/kern.log, dmesg output, and journald for the specific warning signature at mm/truncate.c:89
Correlate FUSE mount events with subsequent kernel warnings during file close operations
Audit running kernel versions across Linux hosts to identify systems running vulnerable 6.16-rc1 through 6.16-rc3 builds

Monitoring Recommendations

Forward kernel ring buffer output to a centralized logging or SIEM platform for pattern detection
Establish alerting rules for WARN_ON_ONCE traces originating from truncate_folio_batch_exceptionals
Track FUSE mount activity by unprivileged users, particularly on systems with DAX-capable storage

How to Mitigate CVE-2025-38357

Immediate Actions Required

Inventory all Linux systems running kernel versions 6.16-rc1, 6.16-rc2, or 6.16-rc3 and prioritize them for patching
Apply the upstream kernel commits b48878aee8e7 and befd9a71d859e that add the missing DAX entry cleanup to FUSE
Restrict unprivileged FUSE mount capabilities on multi-user systems where the patched kernel cannot be immediately deployed

Patch Information

The fix is available in the mainline Linux kernel through commits b48878aee8e7 and befd9a71d859e. The patch ensures FUSE removes all DAX entries prior to filesystem unmount, mirroring the earlier fix applied to XFS and ext4 in commit 0e2f80afcfa6. Users should update to the latest stable kernel release that incorporates these commits.

Workarounds

Downgrade to a stable kernel version prior to 6.16-rc1 if patching is not immediately feasible
Disable DAX on FUSE-backed filesystems to avoid the code path that triggers the warning
Limit FUSE usage to trusted users by adjusting /etc/fuse.conf and removing the user_allow_other option where not required

bash

# Verify current kernel version and identify vulnerable builds
uname -r

# Check for the warning signature in kernel logs
dmesg | grep -i "truncate_folio_batch_exceptionals"

# Restrict FUSE mount access to root only
chmod 4750 /usr/bin/fusermount3