{"api_version":"1","generated_at":"2026-10-20T18:03:07+00:00","cve":"CVE-2025-40072","urls":{"html":"https://cve.report/CVE-2025-40072","api":"https://cve.report/api/cve/CVE-2025-40072.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-40072","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-40072"},"summary":{"title":"fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing\n\nThe function do_fanotify_mark() does not validate if\nmnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns.\nThis causes a NULL pointer dereference in do_fanotify_mark() if the\npath is not a mount namespace object.\n\nFix this by checking mnt_ns_from_dentry()'s return value before\ndereferencing it.\n\nBefore the patch\n\n$ gcc fanotify_nullptr.c -o fanotify_nullptr\n$ mkdir A\n$ ./fanotify_nullptr\nFanotify fd: 3\nfanotify_mark: Operation not permitted\n$ unshare -Urm\nFanotify fd: 3\nKilled\n\nint main(void){\n    int ffd;\n    ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);\n    if(ffd < 0){\n        perror(\"fanotify_init\");\n        exit(EXIT_FAILURE);\n    }\n\n    printf(\"Fanotify fd: %d\\n\",ffd);\n\n    if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS,\nFAN_MNT_ATTACH, AT_FDCWD, \"A\") < 0){\n        perror(\"fanotify_mark\");\n        exit(EXIT_FAILURE);\n    }\n\nreturn 0;\n}\n\nAfter the patch\n\n$ gcc fanotify_nullptr.c -o fanotify_nullptr\n$ mkdir A\n$ ./fanotify_nullptr\nFanotify fd: 3\nfanotify_mark: Operation not permitted\n$ unshare -Urm\nFanotify fd: 3\nfanotify_mark: Invalid argument\n\n[   25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038\n[   25.695006] #PF: supervisor read access in kernel mode\n[   25.695012] #PF: error_code(0x0000) - not-present page\n[   25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0\n[   25.695025] Oops: Oops: 0000 [#1] SMP NOPTI\n[   25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not\ntainted 6.17.0-rc4 #1 PREEMPT(lazy)\n[   25.695040] Hardware name: VMware, Inc. VMware Virtual\nPlatform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\n[   25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950\n[   25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54\n24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b\n5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28\n85 c9\n[   25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203\n[   25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220\n[   25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180\n[   25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000\n[   25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7\n[   25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0\n[   25.695154] FS:  00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000)\nknlGS:0000000000000000\n[   25.695162] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0\n[   25.695201] Call Trace:\n[   25.695209]  <TASK>\n[   25.695215]  __x64_sys_fanotify_mark+0x1f/0x30\n[   25.695222]  do_syscall_64+0x82/0x2c0\n...","state":"PUBLISHED","assigner":"Linux","published_at":"2025-10-28 12:15:41","updated_at":"2026-10-19 21:10:00"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/73ce2a774ad6497cbd48dc4f8a5d699bc417f3fa","name":"https://git.kernel.org/stable/c/73ce2a774ad6497cbd48dc4f8a5d699bc417f3fa","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd","name":"https://git.kernel.org/stable/c/62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40072","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40072","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 58f5fbeb367ff6f30a2448b2cad70f70b2de4b06 73ce2a774ad6497cbd48dc4f8a5d699bc417f3fa git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 58f5fbeb367ff6f30a2448b2cad70f70b2de4b06 62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.16","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17.3 6.17.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"40072","cve":"CVE-2025-40072","epss":"0.001840000","percentile":"0.075660000","score_date":"2026-10-19","updated_at":"2026-10-20 00:13:48"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/notify/fanotify/fanotify_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"73ce2a774ad6497cbd48dc4f8a5d699bc417f3fa","status":"affected","version":"58f5fbeb367ff6f30a2448b2cad70f70b2de4b06","versionType":"git"},{"lessThan":"62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd","status":"affected","version":"58f5fbeb367ff6f30a2448b2cad70f70b2de4b06","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/notify/fanotify/fanotify_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.17.*","status":"unaffected","version":"6.17.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.18","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17.3","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18","versionStartIncluding":"6.16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing\n\nThe function do_fanotify_mark() does not validate if\nmnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns.\nThis causes a NULL pointer dereference in do_fanotify_mark() if the\npath is not a mount namespace object.\n\nFix this by checking mnt_ns_from_dentry()'s return value before\ndereferencing it.\n\nBefore the patch\n\n$ gcc fanotify_nullptr.c -o fanotify_nullptr\n$ mkdir A\n$ ./fanotify_nullptr\nFanotify fd: 3\nfanotify_mark: Operation not permitted\n$ unshare -Urm\nFanotify fd: 3\nKilled\n\nint main(void){\n    int ffd;\n    ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);\n    if(ffd < 0){\n        perror(\"fanotify_init\");\n        exit(EXIT_FAILURE);\n    }\n\n    printf(\"Fanotify fd: %d\\n\",ffd);\n\n    if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS,\nFAN_MNT_ATTACH, AT_FDCWD, \"A\") < 0){\n        perror(\"fanotify_mark\");\n        exit(EXIT_FAILURE);\n    }\n\nreturn 0;\n}\n\nAfter the patch\n\n$ gcc fanotify_nullptr.c -o fanotify_nullptr\n$ mkdir A\n$ ./fanotify_nullptr\nFanotify fd: 3\nfanotify_mark: Operation not permitted\n$ unshare -Urm\nFanotify fd: 3\nfanotify_mark: Invalid argument\n\n[   25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038\n[   25.695006] #PF: supervisor read access in kernel mode\n[   25.695012] #PF: error_code(0x0000) - not-present page\n[   25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0\n[   25.695025] Oops: Oops: 0000 [#1] SMP NOPTI\n[   25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not\ntainted 6.17.0-rc4 #1 PREEMPT(lazy)\n[   25.695040] Hardware name: VMware, Inc. VMware Virtual\nPlatform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\n[   25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950\n[   25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54\n24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b\n5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28\n85 c9\n[   25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203\n[   25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220\n[   25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180\n[   25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000\n[   25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7\n[   25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0\n[   25.695154] FS:  00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000)\nknlGS:0000000000000000\n[   25.695162] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0\n[   25.695201] Call Trace:\n[   25.695209]  <TASK>\n[   25.695215]  __x64_sys_fanotify_mark+0x1f/0x30\n[   25.695222]  do_syscall_64+0x82/0x2c0\n..."}],"providerMetadata":{"dateUpdated":"2026-05-11T21:41:56.450Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/73ce2a774ad6497cbd48dc4f8a5d699bc417f3fa"},{"url":"https://git.kernel.org/stable/c/62e59ffe8787b5550ccff70c30b6f6be6a3ac3dd"}],"title":"fanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-40072","datePublished":"2025-10-28T11:48:39.999Z","dateReserved":"2025-04-16T07:20:57.160Z","dateUpdated":"2026-05-11T21:41:56.450Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-10-28 12:15:41","lastModifiedDate":"2026-10-19 21:10:00","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"40072","Ordinal":"1","Title":"fanotify: Validate the return value of mnt_ns_from_dentry() befo","CVE":"CVE-2025-40072","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"40072","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: Validate the return value of mnt_ns_from_dentry() before dereferencing\n\nThe function do_fanotify_mark() does not validate if\nmnt_ns_from_dentry() returns NULL before dereferencing mntns->user_ns.\nThis causes a NULL pointer dereference in do_fanotify_mark() if the\npath is not a mount namespace object.\n\nFix this by checking mnt_ns_from_dentry()'s return value before\ndereferencing it.\n\nBefore the patch\n\n$ gcc fanotify_nullptr.c -o fanotify_nullptr\n$ mkdir A\n$ ./fanotify_nullptr\nFanotify fd: 3\nfanotify_mark: Operation not permitted\n$ unshare -Urm\nFanotify fd: 3\nKilled\n\nint main(void){\n    int ffd;\n    ffd = fanotify_init(FAN_CLASS_NOTIF | FAN_REPORT_MNT, 0);\n    if(ffd < 0){\n        perror(\"fanotify_init\");\n        exit(EXIT_FAILURE);\n    }\n\n    printf(\"Fanotify fd: %d\\n\",ffd);\n\n    if(fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MNTNS,\nFAN_MNT_ATTACH, AT_FDCWD, \"A\") < 0){\n        perror(\"fanotify_mark\");\n        exit(EXIT_FAILURE);\n    }\n\nreturn 0;\n}\n\nAfter the patch\n\n$ gcc fanotify_nullptr.c -o fanotify_nullptr\n$ mkdir A\n$ ./fanotify_nullptr\nFanotify fd: 3\nfanotify_mark: Operation not permitted\n$ unshare -Urm\nFanotify fd: 3\nfanotify_mark: Invalid argument\n\n[   25.694973] BUG: kernel NULL pointer dereference, address: 0000000000000038\n[   25.695006] #PF: supervisor read access in kernel mode\n[   25.695012] #PF: error_code(0x0000) - not-present page\n[   25.695017] PGD 109a30067 P4D 109a30067 PUD 142b46067 PMD 0\n[   25.695025] Oops: Oops: 0000 [#1] SMP NOPTI\n[   25.695032] CPU: 4 UID: 1000 PID: 1478 Comm: fanotify_nullpt Not\ntainted 6.17.0-rc4 #1 PREEMPT(lazy)\n[   25.695040] Hardware name: VMware, Inc. VMware Virtual\nPlatform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\n[   25.695049] RIP: 0010:do_fanotify_mark+0x817/0x950\n[   25.695066] Code: 04 00 00 e9 45 fd ff ff 48 8b 7c 24 48 4c 89 54\n24 18 4c 89 5c 24 10 4c 89 0c 24 e8 b3 11 fc ff 4c 8b 54 24 18 4c 8b\n5c 24 10 <48> 8b 78 38 4c 8b 0c 24 49 89 c4 e9 13 fd ff ff 8b 4c 24 28\n85 c9\n[   25.695081] RSP: 0018:ffffd31c469e3c08 EFLAGS: 00010203\n[   25.695104] RAX: 0000000000000000 RBX: 0000000001000000 RCX: ffff8eb48aebd220\n[   25.695110] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8eb4835e8180\n[   25.695115] RBP: 0000000000000111 R08: 0000000000000000 R09: 0000000000000000\n[   25.695142] R10: ffff8eb48a7d56c0 R11: ffff8eb482bede00 R12: 00000000004012a7\n[   25.695148] R13: 0000000000000110 R14: 0000000000000001 R15: ffff8eb48a7d56c0\n[   25.695154] FS:  00007f8733bda740(0000) GS:ffff8eb61ce5f000(0000)\nknlGS:0000000000000000\n[   25.695162] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   25.695170] CR2: 0000000000000038 CR3: 0000000136994006 CR4: 00000000003706f0\n[   25.695201] Call Trace:\n[   25.695209]  <TASK>\n[   25.695215]  __x64_sys_fanotify_mark+0x1f/0x30\n[   25.695222]  do_syscall_64+0x82/0x2c0\n...","Type":"Description","Title":"fanotify: Validate the return value of mnt_ns_from_dentry() befo"}]}}}