Junglewise Threat Intelligence

CVE-2025-38231: Linux Kernel NFSD NULL pointer dereference in nfs4_state_start_net

CVE-2025-38231 · Severity: medium · CVSS 5.5 · Published 2025-07-04

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a local user to cause a system crash. The issue occurs during the startup of the NFS service when internal cleanup tasks run before the system is fully initialized. This results in a 'NULL pointer dereference' which leads to a kernel panic and service outage.

Technical details

A race condition exists in nfs4_state_start_net() where the laundromat_work delayed task may execute before nfsd_ssc is properly initialized. This occurs when the kernel experiences delays waiting for userspace responses (e.g., via cld_pipe_upcall) during the grace period transition. When laundromat_work calls nfsd4_ssc_expire_umount, it attempts to access the uninitialized nfsd_ssc pointer, resulting in a NULL pointer dereference. The fix involves reordering the initialization sequence in fs/nfsd/nfssvc.c to ensure nfsd4_ssc_init_umount_work() completes before nfs4_state_start_net() is invoked. This is reachable by a local attacker with sufficient privileges to trigger NFS service restarts or network namespace operations.

Affected products

  • Linux Linux Kernel 5.10.220 to 5.10.239, 5.14 to 5.15.186, 5.16 to 6.1.142, 6.2 to 6.6.95, 6.7 to 6.12.35, 6.13 to 6.15.4

Timeline

  • 2025-07-04: disclosed: Initial publication of the vulnerability details.
  • 2025-06-27: patched: Fixes committed to various stable kernel branches.

References

Related threats