CVE-2025-38231

What it actually does

NULL pointer dereference in nfsd when laundromat_work executes before nfsd_ssc initialization completes in nfs4_state_start_net due to delayed userspace responses during grace period handling.

Why it matters to the business

Potential kernel crashes causing denial of service on NFSv4 servers, disrupting file sharing operations; low EPSS and absence from KEV indicate limited exploitation likelihood despite 480 days since publication and mentions of related kernel privilege escalation campaigns.

How an attack unfolds

An attacker with local access triggers nfs4_state_start_net during NFSv4 startup, induces delays in cld_pipe_upcall paths to allow laundromat_work to run prematurely via nfs4_laundromat, dereferencing uninitialized nfsd_ssc; listed threat actors such as Advanced Spyware Campaign and various Linux Kernel Privilege Escalation groups have targeted similar kernel flaws for escalation.

How to fix it

Apply the fix by updating to the specified commit a43d53d54034805e3e404702a01312fa0c40b623 in affected GIT repositories; ensure nfsd_ssc initialization occurs before laundromat_work scheduling in nfs4_state_start_net.

How to confirm the fix worked

Confirm the code change moving nfsd_ssc initialization ahead of laundromat_work start; test NFSv4 startup under simulated userspace delay conditions to verify absence of NULL dereference.

Typical attack path

1. Obtain local access on an affected Linux system running NFSv4
2. Initiate NFS state operations that invoke nfs4_state_start_net
3. Force delays in userspace responses during nfsd4_end_grace and cld_pipe_upcall
4. Allow delayed laundromat_work to execute before nfsd_ssc initialization
5. Trigger NULL pointer dereference leading to kernel crash

How to detect it

Examine kernel logs and dmesg for NULL pointer dereference or oops messages referencing nfs4_laundromat, nfsd_ssc, or nfs4_state_start_net during NFS startup; correlate with userspace upcall delays in audit or system logs.

What your security team should do

• Patch all systems hosting NFSv4 services to the fixed commit without delay
• Review kernel logs for nfsd-related oops or NULL dereference entries post-startup
• Monitor EPSS trends and related kernel privilege escalation reports for increased risk
• Limit local access and NFS exposure on high-value systems until updated