7.8

CVE-2025-22072: linux

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2025-22072DEBIAN-CVE-2025-22072
Published 16-04-2025Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2025-22072 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.2% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.21%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 21 · Related 17
DLA-4193-1DSA-5907-1MGASA-2025-0142MGASA-2025-0146USN-7594-1USN-7594-2

Timeline

  1. 16-04-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: spufs: fix gang directory lifetimes prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have a problem with gang lifetimes - creation of a gang returns opened gang directory, which normally gets removed when that gets closed, but if somebody has created a context belonging to that gang and kept it alive until the gang got closed, removal failed and we ended up with a leak. Unfortunately, it had been fixed the wrong way. Dentry of gang directory was no longer pinned, and rmdir on close was gone. One problem was that failure of open kept calling simple_rmdir() as cleanup, which meant an unbalanced dput(). Another bug was in the success case - gang creation incremented link count on root directory, but that was no longer undone when gang got destroyed. Fix consists of * reverting the commit in question * adding a counter to gang, protected by ->i_rwsem of gang directory inode. * having it set to 1 at creation time, dropped in both spufs_dir_close() and spufs_gang_close() and bumped in spufs_create_context(), provided that it's not 0. * using simple_recursive_removal() to take the gang directory out when counter reaches zero.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

0.00 pp

From 0.21% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu138 products
  • linuxAll versions (No fix recorded) | < 6.8.0-86.87
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1041.43
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 877907d37da9694a34adc9dc3e2ce09400148cb5, < 880e7b3da2e765c1f90c94c0539be039e96c7062 | ≥ 877907d37da9694a34adc9dc3e2ce09400148cb5, < 324f280806aab28ef757aecc18df419676c10ef8 | ≥ 877907d37da9694a34adc9dc3e2ce09400148cb5, < 029d8c711f5e5fe8cf63e8a4a1a140a06e224e45 | ≥ 877907d37da9694a34adc9dc3e2ce09400148cb5, < 903733782f3ae28a2f7fe4dfb47c7fe3e079a528 | ≥ 877907d37da9694a34adc9dc3e2ce09400148cb5, < fc646a6c6d14b5d581f162a7e32999f789e3a3ac | ≥ 877907d37da9694a34adc9dc3e2ce09400148cb5, < c134deabf4784e155d360744d4a6a835b9de4dd4 | 2.6.22
  • linux_kernel≥ 2.6.23, < 6.1.134 | ≥ 6.2, < 6.6.87 | ≥ 6.7, < 6.12.23 | ≥ 6.13, < 6.13.11 | ≥ 6.14, < 6.14.2 | 2.6.22 | 2.6.22:rc5 | 2.6.22:rc6 | 2.6.22:rc7
Debian1 product
  • linux< 6.1.135-1 | < 6.12.25-1

3 vendors · 141 products

References

29 links
Show all 29 references