What’s Vulnerable › Vulnerabilities

CVE-2015-2925

• Severity: medium (CVSS 6.9 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-11-16 · updated 2026-06-17

Description

The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack."

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 15.04
• Debian Linux: 7.0, 8.0
• Linux kernel: before 3.2.72; from 3.3 before 3.4.110; from 3.5 before 3.10.91; from 3.11 before 3.12.49; from 3.13 before 3.14.55; from 3.15 before 3.16.35 — fixed in 3.10.91, 3.12.49, 3.14.55, 3.16.35, 3.18.23, 3.2.72

How to fix

Upgrade to a fixed version: Linux kernel 3.10.91, 3.12.49, 3.14.55, 3.16.35. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=397d425dc26da728396e66d392d5dcb8dac30c37
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cde93be45a8a90d8c264c776fab63487b5038a65
• http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00009.html
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00017.html
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00018.html
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.html
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00021.html
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00022.html

Get alerted when CVE-2015-2925 or the next vulnerability affects your stack