CVE-2025-38231nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
Updated under an hour ago ()
Does this affect you?
It affects Linux and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized, this can cause NULL pointer dereference. Normally the delayed start of laundromat_work allows sufficient time for nfsd_ssc initialization to complete. However, when the kernel waits too long for userspace responses (e.g. in nfs4_state_start_net -> nfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done -> cld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the delayed work may start before nfsd_ssc initialization finishes. Fix this by moving nfsd_ssc initialization before starting laundromat_work.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Not yet received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from a4bc287943f5695209ff36bdc89f17b48d68fae7 before deaeb74ae9318252829c59a84a7d2316fc335660; from f4e44b393389c77958f7c58bf4415032b4cda15b before 0fccf5f01ed28725cc313a66ca1247eef911d55e; from f4e44b393389c77958f7c58bf4415032b4cda15b before a97668ec6d73dab237cd1c15efe012a10090a4ed; from f4e44b393389c77958f7c58bf4415032b4cda15b before 5060e1a5fef184bd11d298e3f0ee920d96a23236; from f4e44b393389c77958f7c58bf4415032b4cda15b before d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0; from f4e44b393389c77958f7c58bf4415032b4cda15b before 83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64; from f4e44b393389c77958f7c58bf4415032b4cda15b before b31da62889e6d610114d81dc7a6edbcaa503fcf8; from 5.10.220 before 5.10.239 | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.5 | CISA ADP |
References
- https://git.kernel.org/stable/c/deaeb74ae9318252829c59a84a7d2316fc335660
- https://git.kernel.org/stable/c/0fccf5f01ed28725cc313a66ca1247eef911d55e
- https://git.kernel.org/stable/c/a97668ec6d73dab237cd1c15efe012a10090a4ed
- https://git.kernel.org/stable/c/5060e1a5fef184bd11d298e3f0ee920d96a23236
- https://git.kernel.org/stable/c/d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0
- https://git.kernel.org/stable/c/83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64
- https://git.kernel.org/stable/c/b31da62889e6d610114d81dc7a6edbcaa503fcf8
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.