Cloudanix VulnDB

CVE-2025-38232

Medium · 4.7

CVSS

4.7

EPSS

0.2%

Published

Jul 4, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in the Linux kernel's NFS server code can make the whole system crash when certain administrative commands run at the same time.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in Linux kernel NFSD between create_proc_exports_entry during init_nfsd and remove_proc_entry during exit_nfsd allows concurrent exportfs -r and nfsd mount operations to trigger NULL pointer dereference or invalid paging requests in exports_net_open, cache_seq_next_rcu, or related seq functions.

Why it matters to the business

NFS server systems may suffer repeated kernel crashes and reboots when export and module load operations overlap, resulting in unplanned downtime for file sharing services.

How an attack unfolds

Local attacker runs concurrent loops of exportfs -r and nfsd module load/mount/umount to hit the initialization race window, causing kernel oops and potential denial of service.

How to fix it

Apply the upstream fix that moves proc export creation to the end of init_nfsd and cleanup to the start of exit_nfsd; update affected kernels or rebuild nfsd module with corrected ordering.

How to confirm the fix worked

Execute the provided reproduction script after patching and confirm absence of kernel oops or crashes referencing exports_net_open or cache_seq_next_rcu.

Typical attack path

  1. Start loop executing exportfs -r
  2. Concurrently load nfsd.ko and mount -t nfsd none /proc/fs/nfsd
  3. Trigger umount and rmmod in parallel loop
  4. Observe kernel NULL dereference or paging fault in nfsd proc handlers

How to detect it

Search kernel logs and oops reports for stack traces containing exports_net_open, exports_proc_open, cache_seq_next_rcu, or nfsd module symbols during concurrent exportfs and mount activity.

  • exports_net_open+0x50/0x68 [nfsd]
  • cache_seq_next_rcu+0x78/0xa4
  • Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
  • Unable to handle kernel paging request at virtual address 00001f4800001f48
  • nfsd_init_net+0x6c/0x108 [nfsd]

What your security team should do

  • Prioritize kernel updates containing the NFSD proc ordering fix
  • Add monitoring for nfsd-related kernel oops in system logs
  • Limit unprivileged local access on systems exposing nfsd until patched

The record

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix race between nfsd registration and exports_proc As of now nfsd calls create_proc_exports_entry() at start of init_nfsd and cleanup by remove_proc_entry() at last of exit_nfsd. Which causes kernel OOPs if there is race between below 2 operations: (i) exportfs -r (ii) mount -t nfsd none /proc/fs/nfsd for 5.4 kernel ARM64: CPU 1: el1_irq+0xbc/0x180 arch_counter_get_cntvct+0x14/0x18 running_clock+0xc/0x18 preempt_count_add+0x88/0x110 prep_new_page+0xb0/0x220 get_page_from_freelist+0x2d8/0x1778 __alloc_pages_nodemask+0x15c/0xef0 __vmalloc_node_range+0x28c/0x478 __vmalloc_node_flags_caller+0x8c/0xb0 kvmalloc_node+0x88/0xe0 nfsd_init_net+0x6c/0x108 [nfsd] ops_init+0x44/0x170 register_pernet_operations+0x114/0x270 register_pernet_subsys+0x34/0x50 init_nfsd+0xa8/0x718 [nfsd] do_one_initcall+0x54/0x2e0 CPU 2 : Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 PC is at : exports_net_open+0x50/0x68 [nfsd] Call trace: exports_net_open+0x50/0x68 [nfsd] exports_proc_open+0x2c/0x38 [nfsd] proc_reg_open+0xb8/0x198 do_dentry_open+0x1c4/0x418 vfs_open+0x38/0x48 path_openat+0x28c/0xf18 do_filp_open+0x70/0xe8 do_sys_open+0x154/0x248 Sometimes it crashes at exports_net_open() and sometimes cache_seq_next_rcu(). and same is happening on latest 6.14 kernel as well: [ 0.000000] Linux version 6.14.0-rc5-next-20250304-dirty ... [ 285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48 ... [ 285.464902] pc : cache_seq_next_rcu+0x78/0xa4 ... [ 285.469695] Call trace: [ 285.470083] cache_seq_next_rcu+0x78/0xa4 (P) [ 285.470488] seq_read+0xe0/0x11c [ 285.470675] proc_reg_read+0x9c/0xf0 [ 285.470874] vfs_read+0xc4/0x2fc [ 285.471057] ksys_read+0x6c/0xf4 [ 285.471231] __arm64_sys_read+0x1c/0x28 [ 285.471428] invoke_syscall+0x44/0x100 [ 285.471633] el0_svc_common.constprop.0+0x40/0xe0 [ 285.471870] do_el0_svc_compat+0x1c/0x34 [ 285.472073] el0_svc_compat+0x2c/0x80 [ 285.472265] el0t_32_sync_handler+0x90/0x140 [ 285.472473] el0t_32_sync+0x19c/0x1a0 [ 285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3) [ 285.473422] ---[ end trace 0000000000000000 ]--- It reproduced simply with below script: while [ 1 ] do /exportfs -r done & while [ 1 ] do insmod /nfsd.ko mount -t nfsd none /proc/fs/nfsd umount /proc/fs/nfsd rmmod nfsd done & So exporting interfaces to user space shall be done at last and cleanup at first place. With change there is no Kernel OOPs.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 No fix
Linux Kernel 0 6.12.35
Linux Kernel 5.12.0 5.15.199
Linux Kernel 5.12.0 6.12.35
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.6.1.160000.2.4
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.6.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.6.1

Related vulnerabilities