Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) implementation can cause a system crash. The issue occurs when the system attempts to process file updates on a network share but encounters an unexpected empty data structure. This could lead to a denial-of-service condition, impacting the availability of servers or industrial controllers that rely on these network file services.
Technical details
A vulnerability exists in the Linux kernel's NFSv4 pNFS (parallel NFS) implementation due to a failure to clear the NFS_INO_LAYOUTCOMMIT flag in the pnfs_mark_layout_stateid_invalid function. When a layout state ID is invalidated, the system may still attempt to perform a layout commit if the flag remains set. This results in a null pointer dereference when the kernel attempts to reference a layout that has already been freed or is null during the write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode call stack. The fix involves explicitly clearing the NFS_INO_LAYOUTCOMMIT bit when marking the layout state ID as invalid. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel fe1cf9469d7bc to 084bebe82ad86f718a3af84f34761863e63164ed
- Linux Linux Kernel fe1cf9469d7bc to b6e4e3a08c03200cc4b8067ec8ab3172a989d6fc
- Linux Linux Kernel fe1cf9469d7bc to 104080582ae0aa6dce6c6d75ff89062efe84673b
- Linux Linux Kernel fe1cf9469d7bc to f718f9ea6094843b8c059b073af49ad61e9f49bb
- Linux Linux Kernel fe1cf9469d7bc to 59947dff0fb7c19c09ce6dccbcd253fd542b6c25
- Linux Linux Kernel fe1cf9469d7bc to ca2e7fdad7c683b64821c94a58b9b68733214dad
- Linux Linux Kernel fe1cf9469d7bc to 38694f9aae00459ab443a7dc8b3949a6b33b560a
- Linux Linux Kernel fe1cf9469d7bc to e0f8058f2cb56de0b7572f51cd563ca5debce746
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and earlier
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6 and earlier
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and earlier
Timeline
- 2025-12-24: advisory: Initial CVE publication
- 2026-01-19: patched: Stable kernel patch applied
References
- https://git.kernel.org/stable/c/084bebe82ad86f718a3af84f34761863e63164ed
- https://git.kernel.org/stable/c/104080582ae0aa6dce6c6d75ff89062efe84673b
- https://git.kernel.org/stable/c/38694f9aae00459ab443a7dc8b3949a6b33b560a
- https://git.kernel.org/stable/c/59947dff0fb7c19c09ce6dccbcd253fd542b6c25
- https://git.kernel.org/stable/c/b6e4e3a08c03200cc4b8067ec8ab3172a989d6fc
- https://git.kernel.org/stable/c/ca2e7fdad7c683b64821c94a58b9b68733214dad
- https://git.kernel.org/stable/c/e0f8058f2cb56de0b7572f51cd563ca5debce746