VulnerabilityPublished 18 Jun 2025Updated 5 Nov 2026

CVE-2025-38023: Linux kernel · nfs: handle failure of nfs_get_lock_context in unlock path

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f601960af04d2ecb007c928ba153d34051acd9c1 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 21:04 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in f601960af04d2ecb007c928ba153d34051acd9c1, db6f5ee1fc8f54d079d0751292c2fc2d78e3aad1, da824f1271633bcb515ca8084cda3eda4b3ace51 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ f30cb757f680f965ba8a2e53cb3588052a01aeb5, < f601960af04d2ecb007c928ba153d34051acd9c1	Fixed in f601960af04d2ecb007c928ba153d34051acd9c1
LinuxLinux	Affected ≥ f30cb757f680f965ba8a2e53cb3588052a01aeb5, < db6f5ee1fc8f54d079d0751292c2fc2d78e3aad1	Fixed in db6f5ee1fc8f54d079d0751292c2fc2d78e3aad1
LinuxLinux	Affected ≥ f30cb757f680f965ba8a2e53cb3588052a01aeb5, < da824f1271633bcb515ca8084cda3eda4b3ace51	Fixed in da824f1271633bcb515ca8084cda3eda4b3ace51
LinuxLinux	Affected ≥ f30cb757f680f965ba8a2e53cb3588052a01aeb5, < c457dc1ec770a22636b473ce5d35614adfe97636	Fixed in c457dc1ec770a22636b473ce5d35614adfe97636
LinuxLinux	Affected ≥ f30cb757f680f965ba8a2e53cb3588052a01aeb5, < a6879a076b98c99c9fe747816fe1c29543442441	Fixed in a6879a076b98c99c9fe747816fe1c29543442441
LinuxLinux	Affected ≥ f30cb757f680f965ba8a2e53cb3588052a01aeb5, < 85fb7f8ca5f8c138579fdfc9b97b3083e6077d40	Fixed in 85fb7f8ca5f8c138579fdfc9b97b3083e6077d40

Description

In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure of nfs_get_lock_context in unlock path When memory is insufficient, the allocation of nfs_lock_context in nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat an nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM) as valid and proceed to execute rpc_run_task(), this will trigger a NULL pointer dereference in nfs4_locku_prepare. For example: BUG: kernel NULL pointer dereference, address: 000000000000000c PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 15 UID: 0 PID: 12 Comm: kworker/u64:0 Not tainted 6.15.0-rc2-dirty #60 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 Workqueue: rpciod rpc_async_schedule RIP: 0010:nfs4_locku_prepare+0x35/0xc2 Code: 89 f2 48 89 fd 48 c7 c7 68 69 ef b5 53 48 8b 8e 90 00 00 00 48 89 f3 RSP: 0018:ffffbbafc006bdb8 EFLAGS: 00010246 RAX: 000000000000004b RBX: ffff9b964fc1fa00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: fffffffffffffff4 RDI: ffff9ba53fddbf40 RBP: ffff9ba539934000 R08: 0000000000000000 R09: ffffbbafc006bc38 R10: ffffffffb6b689c8 R11: 0000000000000003 R12: ffff9ba539934030 R13: 0000000000000001 R14: 0000000004248060 R15: ffffffffb56d1c30 FS: 0000000000000000(0000) GS:ffff9ba5881f0000(0000) knlGS:00000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000c CR3: 000000093f244000 CR4: 00000000000006f0 Call Trace: <TASK> __rpc_execute+0xbc/0x480 rpc_async_schedule+0x2f/0x40 process_one_work+0x232/0x5d0 worker_thread+0x1da/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0x10d/0x240 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: CR2: 000000000000000c ---[ end trace 0000000000000000 ]--- Free the allocated nfs4_unlockdata when nfs_get_lock_context() fails and return NULL to terminate subsequent rpc_run_task, preventing NULL pointer dereference.

References

Community reviews

Loading reviews…