CVE-2025-38231: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
In the Linux kernel, the following vulnerability has been resolved:
nfsd: Initialize ssc before laundromatwork to prevent NULL dereference
In nfs4statestartnet(), laundromatwork may access nfsdssc through nfs4laundromat -> nfsd4sscexpireumount. If nfsdssc isn't initialized, this can cause NULL pointer dereference.
Normally the delayed start of laundromatwork allows sufficient time for nfsdssc initialization to complete. However, when the kernel waits too long for userspace responses (e.g. in nfs4statestartnet -> nfsd4endgrace -> nfsd4recordgracedone -> nfsd4cldgracedone -> cldpipeupcall -> cldpipeupcall -> waitforcompletion path), the delayed work may start before nfsdssc initialization finishes.
Fix this by moving nfsdssc initialization before starting laundromatwork.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38231?
CVE-2025-38231 is considered a medium severity vulnerability due to the potential for a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2025-38231?
To resolve CVE-2025-38231, update the Linux kernel to a patched version where nfsd_ssc is properly initialized.
Which Linux kernel versions are affected by CVE-2025-38231?
CVE-2025-38231 affects various recent versions of the Linux kernel where nfsd_ssc may not be initialized correctly.
What components are impacted by CVE-2025-38231?
CVE-2025-38231 specifically impacts the NFS (Network File System) related components of the Linux kernel.
Is CVE-2025-38231 being actively exploited?
As of now, there have been no confirmed exploitations reported for CVE-2025-38231.