CVE-2025-38338

What it actually does

Double invocation of folio_unlock() in nfs_return_empty_folio() under fscache-enabled NFS read/truncate races corrupts the PG_locked flag, allowing folio_wait_bit_common() to block indefinitely or triggering netfs_read_collection warnings.

Why it matters to the business

NFS clients may experience kernel deadlocks or hangs during concurrent file reads and truncates from separate clients, causing application stalls and requiring reboots in affected Linux kernel deployments.

How an attack unfolds

An attacker controlling multiple NFS clients triggers a race by reading a file while another client truncates it; the missing nfs_netfs_folio_unlock() check in nfs_return_empty_folio() causes the double-unlock, resulting in permanent lock contention or warnings.

How to fix it

Upgrade linux-lts (Alpaquita:23) to 6.1.89-r0, linux-lts (Alpaquita:stream) to 6.12.41-r0, or apply commit 14f5549ad163be2c018abc1bb38370fff617a243 in the stable kernel tree; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version matches or exceeds the listed fixed releases; reproduce concurrent NFS read/truncate workloads and confirm absence of 'folio is not locked' warnings or stuck processes in folio_wait_bit_common.

Typical attack path

1. Mount NFS share from multiple clients
2. Initiate read operations on target file from one client
3. Concurrently truncate the same file from a second client
4. Trigger timing-dependent path through nfs_read_add_folio and nfs_return_empty_folio
5. Observe deadlock in folio_wait_bit_common or netfs_read_collection warning

How to detect it

Search kernel logs and dmesg for 'folio is not locked', 'netfs_read_collection', 'folio_wait_bit_common', or workqueue traces involving nfs_return_empty_folio; inspect for hung tasks waiting on PG_locked during NFS operations.

• folio 10 is not locked
• WARNING: CPU.*netfs_read_collection
• Workqueue: events_unbound netfs_read_collection_worker
• RIP:.*netfs_read_collection
• folio_unlock.*PG_locked

What your security team should do

• Apply the listed kernel updates immediately on all NFS client systems
• Monitor kernel logs for netfs_read_collection warnings during NFS activity
• Test NFS workloads under concurrent truncate/read conditions post-upgrade
• Prioritize patching in environments with high NFS usage or fscache enabled