CVE-2025-38231

nfsd: Initialize ssc before laundromat_work to prevent NULL dereference

published July 4, 2025

CVSS
—
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Initialize ssc before laundromat_work to prevent NULL dereference

In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through

nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized,

this can cause NULL pointer dereference.

Normally the delayed start of laundromat_work allows sufficient time for

nfsd_ssc initialization to complete. However, when the kernel waits too

long for userspace responses (e.g. in nfs4_state_start_net ->

nfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done ->

cld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the

delayed work may start before nfsd_ssc initialization finishes.

Fix this by moving nfsd_ssc initialization before starting laundromat_work.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00184 · 7.6th percentile
Published
2025-07-04T13:37Z
EPSS history
Timeline
  • 04 JUL 13:37Z
    nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
    cvelistv5