CVE-2025-38231
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized, this can cause NULL pointer dereference. Normally the delayed start of laundromat_work allows sufficient time for nfsd_ssc initialization to complete. However, when the kernel waits too long for userspace responses (e.g. in nfs4_state_start_net -> nfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done -> cld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the delayed work may start before nfsd_ssc initialization finishes. Fix this by moving nfsd_ssc initialization before starting laundromat_work.
How to fix
- linux linux_kernel5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4 or later
- git.kernel.org/stable/c/0fccf5f01ed28725cc313a66ca1247eef911d55e
- git.kernel.org/stable/c/5060e1a5fef184bd11d298e3f0ee920d96a23236
- git.kernel.org/stable/c/83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64
- git.kernel.org/stable/c/a97668ec6d73dab237cd1c15efe012a10090a4ed
- git.kernel.org/stable/c/b31da62889e6d610114d81dc7a6edbcaa503fcf8
- git.kernel.org/stable/c/d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0
- git.kernel.org/stable/c/deaeb74ae9318252829c59a84a7d2316fc335660
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 5.10.220 ≤ v < 5.10.239, 5.14 ≤ v < 5.15.186, 5.16 ≤ v < 6.1.142, 6.2 ≤ v < 6.6.95, 6.7 ≤ v < 6.12.35, 6.13 ≤ v < 6.15.4 | 5.10.239, 5.15.186, 6.1.142, 6.6.95, 6.12.35, 6.15.4 |
| debian debian_linux | 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.