CVE-2025-38023
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-12-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.12 (inc) to 5.4.294 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.238 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.184 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.140 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.92 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.30 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.14.8 (exc) |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
| debian | debian_linux | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to a NULL pointer dereference when handling NFS lock contexts under low memory conditions. A kernel crash can lead to system instability, denial of service, and potential disruption of services relying on NFS. This could affect system availability and reliability.
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's NFS (Network File System) implementation. When the system runs low on memory, the function nfs_get_lock_context() fails to allocate memory for nfs_lock_context and returns an error (-ENOMEM). However, if the code mistakenly treats this error as a valid lock context and proceeds to execute rpc_run_task(), it leads to a NULL pointer dereference in the function nfs4_locku_prepare. This causes a kernel crash (BUG) due to accessing invalid memory. The fix involves properly freeing the allocated nfs4_unlockdata when nfs_get_lock_context() fails and returning NULL to stop further processing, thus preventing the NULL pointer dereference.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the system kernel logs for NULL pointer dereference errors related to NFS, specifically messages mentioning 'nfs4_locku_prepare' and 'BUG: kernel NULL pointer dereference'. You can use commands like 'dmesg | grep -i nfs4_locku_prepare' or 'journalctl -k | grep -i nfs' to look for such kernel oops or crash messages indicating the issue.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by properly handling the failure of nfs_get_lock_context and preventing NULL pointer dereference. Until an update is applied, consider limiting or disabling NFS usage if feasible to reduce exposure.