CVE-2025-38691

What it actually does

Uninitialized pointer dereference in ext_tree_free_commitdata() during retry of ext_tree_prepare_commit() for pNFS block/scsi layout encoding, plus unbounded buffer growth that can exceed RPC limits when encoding many extents.

Why it matters to the business

Kernel crashes or denial of service on systems using pNFS block or SCSI layouts, especially when writing large files without preallocation; high downstream prevalence in container and storage environments increases exposure surface.

How an attack unfolds

An attacker with local access triggers repeated extent encoding in the NFS client by creating or modifying large files without preallocation; the third retry path dereferences an uninitialized layoutupdate_pages array, and excessive extents can also produce oversized layout commits.

How to fix it

Upgrade Linux kernel to commit 579b85f893d9885162e1cabf99a4a088916e143e or later; for MinimOS-based packages upgrade to version 18.0.6-r1 of gitlab-cng, gitlab-base, gitlab-shell, gitaly-config and related components.

How to confirm the fix worked

Confirm presence of the fix commit in the running kernel source; verify that layoutupdate_pages initialization occurs before any call to ext_tree_free_commitdata() and that buffer size is capped before RPC transmission.

Typical attack path

1. Obtain local code execution or user access on an affected Linux system
2. Write a large file without preallocating extents to force repeated buffer reallocations in ext_tree_prepare_commit()
3. Trigger the third encoding attempt so that ext_tree_free_commitdata() dereferences the still-uninitialized page array
4. Cause kernel panic or undefined behavior; optionally abuse unbounded buffer growth to exceed server RPC limits

How to detect it

Search kernel logs for oops or panic messages referencing ext_tree_prepare_commit, ext_tree_free_commitdata, or pNFS layout commit; inspect NFS client activity on systems writing large un-preallocated files.

What your security team should do

• Apply the listed kernel and package updates immediately on all systems using pNFS block/scsi layouts
• Prioritize hosts writing large files without extent preallocation
• Monitor for kernel oops or panic logs related to NFS layout commit paths until patches are deployed