CVE-2025-38231

nfsd: Initialize ssc before laundromat_work to prevent NULL dereference

State: Published
Severity: Not scored
Published: Jul 4, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: Initialize ssc before laundromat_work to prevent NULL dereference

In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized, this can cause NULL pointer dereference.

Normally the delayed start of laundromat_work allows sufficient time for nfsd_ssc initialization to complete. However, when the kernel waits too long for userspace responses (e.g. in nfs4_state_start_net -> nfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done -> cld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the delayed work may start before nfsd_ssc initialization finishes.

Fix this by moving nfsd_ssc initialization before starting laundromat_work.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a4bc287943f5695209ff36bdc89f17b48d68fae7 to before deaeb74ae9318252829c59a84a7d2316fc335660Affected f4e44b393389c77958f7c58bf4415032b4cda15b to before 0fccf5f01ed28725cc313a66ca1247eef911d55eAffected f4e44b393389c77958f7c58bf4415032b4cda15b to before a97668ec6d73dab237cd1c15efe012a10090a4edAffected f4e44b393389c77958f7c58bf4415032b4cda15b to before 5060e1a5fef184bd11d298e3f0ee920d96a23236Affected f4e44b393389c77958f7c58bf4415032b4cda15b to before d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0Affected f4e44b393389c77958f7c58bf4415032b4cda15b to before 83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64Affected f4e44b393389c77958f7c58bf4415032b4cda15b to before b31da62889e6d610114d81dc7a6edbcaa503fcf8Affected 5.10.220 to before 5.10.239Affected
LinuxLinux	5.14Affected before 5.14Not affected 5.10.239 through 5.10.Not affected 5.15.186 through 5.15.Not affected 6.1.142 through 6.1.Not affected 6.6.95 through 6.6.Not affected 6.12.35 through 6.12.Not affected 6.15.4 through 6.15.Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

a4bc287943f5695209ff36bdc89f17b48d68fae7 to before deaeb74ae9318252829c59a84a7d2316fc335660Affected
f4e44b393389c77958f7c58bf4415032b4cda15b to before 0fccf5f01ed28725cc313a66ca1247eef911d55eAffected
f4e44b393389c77958f7c58bf4415032b4cda15b to before a97668ec6d73dab237cd1c15efe012a10090a4edAffected
f4e44b393389c77958f7c58bf4415032b4cda15b to before 5060e1a5fef184bd11d298e3f0ee920d96a23236Affected
f4e44b393389c77958f7c58bf4415032b4cda15b to before d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0Affected
f4e44b393389c77958f7c58bf4415032b4cda15b to before 83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64Affected
f4e44b393389c77958f7c58bf4415032b4cda15b to before b31da62889e6d610114d81dc7a6edbcaa503fcf8Affected
5.10.220 to before 5.10.239Affected

LinuxLinux

5.14Affected
before 5.14Not affected
5.10.239 through 5.10.*Not affected
5.15.186 through 5.15.*Not affected
6.1.142 through 6.1.*Not affected
6.6.95 through 6.6.*Not affected
6.12.35 through 6.12.*Not affected
6.15.4 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.