CVE-2025-38023

What it actually does

NULL pointer dereference in nfs4_locku_prepare when nfs_get_lock_context fails to allocate nfs_lock_context under low memory and the error value is treated as a valid context during rpc_run_task execution in the NFS unlock path.

Why it matters to the business

Systems running affected Linux kernels may experience kernel crashes and denial of service during NFS file unlock operations under memory pressure, leading to unplanned downtime and potential data inconsistency in distributed file system workloads.

How an attack unfolds

An attacker with the ability to trigger NFS unlock operations on a system with constrained memory forces nfs_get_lock_context to return -ENOMEM; the erroneous value is stored in the unlock data structure and later dereferenced during asynchronous RPC task preparation, causing a kernel panic.

How to fix it

Upgrade the Linux kernel to the commit db6f5ee1fc8f54d079d0751292c2fc2d78e3aad1 or later stable releases that correctly free nfs4_unlockdata and return NULL on allocation failure; apply vendor-supplied kernel updates for all affected distributions.

How to confirm the fix worked

Verify the presence of the fix commit in the running kernel source or package changelog; reproduce low-memory conditions while performing NFS unlock operations and confirm absence of the NULL dereference oops in kernel logs.

Typical attack path

1. Gain local execution or trigger NFS client operations on the target system
2. Induce memory pressure to cause nfs_get_lock_context allocation failure
3. Initiate an NFS file unlock sequence that reaches nfs4_unlockdata handling
4. Trigger rpc_run_task which calls nfs4_locku_prepare and dereferences the invalid context

How to detect it

Inspect kernel logs for oops messages referencing nfs4_locku_prepare and address 000000000000000c; correlate with NFS unlock activity and memory pressure events in system logs or audit trails.

• BUG: kernel NULL pointer dereference, address: 000000000000000c
• RIP: 0010:nfs4_locku_prepare+0x35/0xc2
• Workqueue: rpciod rpc_async_schedule

What your security team should do

• Prioritize kernel updates on all systems using NFS clients within the next maintenance window
• Monitor memory utilization on NFS client hosts to reduce exposure to allocation failures
• Review and test NFS workload behavior under simulated memory pressure after patching