CVE-2025-22002

What it actually does

Missing NULL check before calling invalidate_cache in netfs_write_collection_worker causes kernel NULL pointer dereference when NETFS_WRITE_TO_CACHE fails on filesystems such as NFS or Ceph that do not implement the method.

Why it matters to the business

Unexpected kernel crashes on Linux systems lead to downtime, potential loss of in-flight I/O, and operational disruption for workloads relying on netfs caching.

How an attack unfolds

A local process or workload triggers a cache write failure condition in netfs; the collection worker then dereferences a NULL function pointer because invalidate_cache was never implemented by the underlying filesystem, resulting in an immediate kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 0def1a40c3e76a468f8f66aa572caed44ec37277 or later; on affected Red Hat EUS releases update squid to 7:4.4-8.module+el8.1.0+10584+c769fd35.3 (or 7:4.4-8.module+el8.2.0+10583+6e4ac934.3) and libecap to 0:1.0.1-2.module+el8.1.0+4044+36416a77.

How to confirm the fix worked

Confirm the presence of the NULL guard before the invalidate_cache call in netfs_write_collection_worker source; reproduce cache-write failure paths and verify the kernel no longer oopses.

Typical attack path

1. Gain local execution on a system using netfs with a filesystem lacking invalidate_cache
2. Induce a failed NETFS_WRITE_TO_CACHE operation
3. netfs_write_collection_worker executes and hits the missing NULL guard
4. Kernel performs supervisor instruction fetch at address 0 and panics

How to detect it

Search kernel logs and dmesg for NULL pointer dereference oopses containing netfs_write_collection_worker, page_fault_oops, and RIP at address 0; correlate with kworker threads performing netfs cache writes.

• BUG: kernel NULL pointer dereference, address: 0000000000000000
• netfs_write_collection_worker+0xe9f/0x12b0
• RIP: 0010:0x0
• Workqueue: events_unbound netfs_write_collection_worker

What your security team should do

• Apply the referenced kernel and package updates within the next maintenance window
• Add kernel oops monitoring for netfs_write_collection_worker signatures
• Limit use of write-to-cache on affected filesystems until patched