CVE-2025-38393

NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN

State: Published
Severity: 7.5 High
Published: Jul 25, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN

We found a few different systems hung up in writeback waiting on the same page lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in pnfs_update_layout(), however the pnfs_layout_hdr's plh_outstanding count was zero.

It seems most likely that this is another race between the waiter and waker similar to commit ed0172af5d6f ("SUNRPC: Fix a race to wake a sync task"). Fix it up by applying the advised barrier.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8acc3e228e1c90bd410f73597a4549e0409f22d6 to before 08287df60bac5b008b6bcdb03053988335d3d282Affected ec23a86e060cbe30b62eb2955adc97c92d80cc4c to before 8846fd02c98da8b79e6343a20e6071be6f372180Affected 880265c77ac415090090d1fe72a188fee71cb458 to before e4b13885e7ef1e64e45268feef1e5f0707c47e72Affected 880265c77ac415090090d1fe72a188fee71cb458 to before 8ca65fa71024a1767a59ffbc6a6e2278af84735eAffected 880265c77ac415090090d1fe72a188fee71cb458 to before 864a54c1243ed3ca60baa4bc492dede1361f4c83Affected 880265c77ac415090090d1fe72a188fee71cb458 to before 1f4da20080718f258e189a2c5f515385fa393da6Affected 880265c77ac415090090d1fe72a188fee71cb458 to before c01776287414ca43412d1319d2877cbad65444acAffected f133819e24e78f3aaaa00e9fa2b816d5f73fd172Affected 5.10.124 to before 5.10.240Affected 5.15.49 to before 5.15.187Affected 5.18.6 to before 5.19Affected
LinuxLinux	5.19Affected before 5.19Not affected 5.10.240 through 5.10.Not affected 5.15.187 through 5.15.Not affected 6.1.144 through 6.1.Not affected 6.6.97 through 6.6.Not affected 6.12.37 through 6.12.Not affected 6.15.6 through 6.15.Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

8acc3e228e1c90bd410f73597a4549e0409f22d6 to before 08287df60bac5b008b6bcdb03053988335d3d282Affected
ec23a86e060cbe30b62eb2955adc97c92d80cc4c to before 8846fd02c98da8b79e6343a20e6071be6f372180Affected
880265c77ac415090090d1fe72a188fee71cb458 to before e4b13885e7ef1e64e45268feef1e5f0707c47e72Affected
880265c77ac415090090d1fe72a188fee71cb458 to before 8ca65fa71024a1767a59ffbc6a6e2278af84735eAffected
880265c77ac415090090d1fe72a188fee71cb458 to before 864a54c1243ed3ca60baa4bc492dede1361f4c83Affected
880265c77ac415090090d1fe72a188fee71cb458 to before 1f4da20080718f258e189a2c5f515385fa393da6Affected
880265c77ac415090090d1fe72a188fee71cb458 to before c01776287414ca43412d1319d2877cbad65444acAffected
f133819e24e78f3aaaa00e9fa2b816d5f73fd172Affected
5.10.124 to before 5.10.240Affected
5.15.49 to before 5.15.187Affected
5.18.6 to before 5.19Affected

LinuxLinux

5.19Affected
before 5.19Not affected
5.10.240 through 5.10.*Not affected
5.15.187 through 5.15.*Not affected
6.1.144 through 6.1.*Not affected
6.6.97 through 6.6.*Not affected
6.12.37 through 6.12.*Not affected
6.15.6 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.