Junglewise Threat Intelligence

CVE-2025-68349: Linux Kernel null pointer dereference in NFSv4 pNFS

CVE-2025-68349 · Severity: info · Published 2025-12-24

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's Network File System (NFS) implementation can cause a system crash. The issue occurs when the system attempts to process file updates on a network share but encounters an unexpected empty data structure. This could lead to a denial-of-service condition, impacting the availability of servers or industrial controllers that rely on these network file services.

Technical details

A vulnerability exists in the Linux kernel's NFSv4 pNFS (parallel NFS) implementation due to a failure to clear the NFS_INO_LAYOUTCOMMIT flag in the pnfs_mark_layout_stateid_invalid function. When a layout state ID is invalidated, the system may still attempt to perform a layout commit if the flag remains set. This results in a null pointer dereference when the kernel attempts to reference a layout that has already been freed or is null during the write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode call stack. The fix involves explicitly clearing the NFS_INO_LAYOUTCOMMIT bit when marking the layout state ID as invalid. Patches have been released for various stable kernel branches.

Affected products

  • Linux Linux Kernel fe1cf9469d7bc to 084bebe82ad86f718a3af84f34761863e63164ed
  • Linux Linux Kernel fe1cf9469d7bc to b6e4e3a08c03200cc4b8067ec8ab3172a989d6fc
  • Linux Linux Kernel fe1cf9469d7bc to 104080582ae0aa6dce6c6d75ff89062efe84673b
  • Linux Linux Kernel fe1cf9469d7bc to f718f9ea6094843b8c059b073af49ad61e9f49bb
  • Linux Linux Kernel fe1cf9469d7bc to 59947dff0fb7c19c09ce6dccbcd253fd542b6c25
  • Linux Linux Kernel fe1cf9469d7bc to ca2e7fdad7c683b64821c94a58b9b68733214dad
  • Linux Linux Kernel fe1cf9469d7bc to 38694f9aae00459ab443a7dc8b3949a6b33b560a
  • Linux Linux Kernel fe1cf9469d7bc to e0f8058f2cb56de0b7572f51cd563ca5debce746
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and earlier
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6 and earlier
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and earlier

Timeline

  • 2025-12-24: advisory: Initial CVE publication
  • 2026-01-19: patched: Stable kernel patch applied

References

Related threats