CVE-2025-68185

What it actually does

Race condition in nfs4_setup_readdir allows concurrent dereference of d_parent->d_inode without d_lock protection, enabling invalid memory access during XDR encoding.

Why it matters to the business

May trigger kernel instability or crashes in NFSv4 environments under heavy concurrent directory access, though exploitation remains difficult outside controlled virtualized setups; widespread kernel deployments increase exposure surface.

How an attack unfolds

An attacker triggers parallel directory operations while readdir is active to widen the unprotected dereference window in nfs4_setup_readdir, potentially causing an oops; the race is theoretically exploitable on KVM but practically hard to hit on physical hardware.

How to fix it

Update affected Linux kernels to the fixed commit 6025f641a0e30afdc5aa62017397b1860ad9f677 or later; for Chainguard images upgrade cluster-autoscaler-fips-1.32 and cluster-autoscaler-fips-1.32-compat to 1.32.0-r3 or newer.

How to confirm the fix worked

Verify the presence of the d_lock acquisition around put_unaligned_be64 in nfs4_setup_readdir after applying the update; confirm kernel builds contain commit 6025f641a0e30afdc5aa62017397b1860ad9f677.

Typical attack path

1. Mount an NFSv4 share and begin readdir operations
2. Concurrently modify directory entries from another process or client
3. Force the unprotected d_parent->d_inode dereference during xdr_encode_hyper
4. Induce kernel oops or memory corruption if the race window is hit

How to detect it

Search kernel logs and dmesg for NFS readdir oops or null pointer dereference messages involving d_parent or xdr_encode_hyper; correlate with high-concurrency directory access patterns.

What your security team should do

• Prioritize kernel package upgrades to the listed fixed versions across all fleets
• Monitor for NFSv4-related kernel oops reports in production logs
• Test concurrent directory workloads in staging environments after patching
• Track EPSS trend and reevaluate if new exploit code emerges