CVE-2025-68349

What it actually does

The flaw is a null pointer dereference in pnfs_layoutcommit_inode during write_inode when NFS_INO_LAYOUTCOMMIT remains set after pnfs_mark_layout_stateid_invalid clears the layout; pnfs_set_layoutcommit relies on lseg refcount that is no longer present.

Why it matters to the business

Unpatched Linux systems using NFSv4/pNFS may experience kernel crashes during file writes, causing service interruptions, data unavailability, and unplanned reboots on NFS clients.

How an attack unfolds

An attacker triggers concurrent NFSv4 layout state invalidation while a write path still has the layout-commit flag set, causing the subsequent pnfs_layoutcommit_inode call to dereference a null layout; no named threat actors or ransomware usage are associated with this issue.

How to fix it

Upgrade the Linux kernel to a version containing commit 084bebe82ad86f718a3af84f34761863e63164ed; apply the fix from the stable git tree and rebuild or install the updated package.

How to confirm the fix worked

Confirm the running kernel contains commit 084bebe82ad86f718a3af84f34761863e63164ed; exercise NFSv4/pNFS write workloads and verify absence of oops in pnfs_layoutcommit_inode.

Typical attack path

1. Obtain local or network access to an NFSv4/pNFS client
2. Perform or induce file writes that set NFS_INO_LAYOUTCOMMIT
3. Force layout invalidation via pnfs_mark_layout_stateid_invalid
4. Trigger write_inode to reach the null-layout dereference

How to detect it

Search kernel logs and crash dumps for stack traces containing nfs4_write_inode, pnfs_layoutcommit_inode, and references to null layout or NFS_INO_LAYOUTCOMMIT; correlate with NFSv4 layout state transitions.

What your security team should do

• Prioritize kernel updates on all NFSv4/pNFS clients within standard change windows
• Add kernel oops monitoring for nfs4_write_inode and pnfs_layoutcommit_inode to existing alerting
• Review NFS mount options to reduce layout commit frequency where operationally acceptable