CVE-2025-68349

NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

State: Published
Severity: 7.5 High
Published: Dec 24, 2025
Updated: Oct 15, 2026
Reserved: Dec 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

Fixes a crash when layout is null during this call stack:

write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode

pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before 084bebe82ad86f718a3af84f34761863e63164edAffected fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before b6e4e3a08c03200cc4b8067ec8ab3172a989d6fcAffected fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before 104080582ae0aa6dce6c6d75ff89062efe84673bAffected fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before f718f9ea6094843b8c059b073af49ad61e9f49bbAffected fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before 59947dff0fb7c19c09ce6dccbcd253fd542b6c25Affected fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before ca2e7fdad7c683b64821c94a58b9b68733214dadAffected fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before 38694f9aae00459ab443a7dc8b3949a6b33b560aAffected fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before e0f8058f2cb56de0b7572f51cd563ca5debce746Affected
LinuxLinux	4.10Affected before 4.10Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.63 through 6.12.Not affected 6.17.13 through 6.17.Not affected 6.18.2 through 6.18.*Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before 084bebe82ad86f718a3af84f34761863e63164edAffected
fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before b6e4e3a08c03200cc4b8067ec8ab3172a989d6fcAffected
fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before 104080582ae0aa6dce6c6d75ff89062efe84673bAffected
fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before f718f9ea6094843b8c059b073af49ad61e9f49bbAffected
fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before 59947dff0fb7c19c09ce6dccbcd253fd542b6c25Affected
fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before ca2e7fdad7c683b64821c94a58b9b68733214dadAffected
fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before 38694f9aae00459ab443a7dc8b3949a6b33b560aAffected
fe1cf9469d7bcb6af27e42eb555a41b0135bce4a to before e0f8058f2cb56de0b7572f51cd563ca5debce746Affected

LinuxLinux

4.10Affected
before 4.10Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.63 through 6.12.*Not affected
6.17.13 through 6.17.*Not affected
6.18.2 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.