CVE-2025-38028: NFS/localio: Fix a race in nfs_local_open_fh()
In the Linux kernel, the following vulnerability has been resolved:
NFS/localio: Fix a race in nfslocalopenfh()
Once the clp->cluuid.lock has been dropped, another CPU could come in and free the struct nfsdfile that was just added. To prevent that from happening, take the RCU read lock before dropping the spin lock.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability has a local attack vector and requires low privileges. No user interaction is required.
Which component is involved in the race condition?
The race occurs in the Linux kernel NFS local I/O path, specifically in nfs_local_open_fh(). It involves an nfsd_file being freed after clp->cl_uuid.lock is dropped.
What is the impact if exploitation succeeds?
The supplied severity vector indicates high impact to confidentiality, integrity, and availability. The race can lead to use of an nfsd_file after another CPU frees it.
What code-level mitigation was applied?
The fix takes an RCU read lock before dropping the clp->cl_uuid spin lock, preventing the referenced nfsd_file from being freed during the affected window.