Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38231— nfsd: Initialize ssc before laundromat_work to prevent NULL dereference

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nfsd未正确初始化ssc导致laundromat_work空指针取消引用。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.18% · P8

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 17

VendorProduct Version RangeStatus
Linux Linux a4bc287943f5695209ff36bdc89f17b48d68fae7< deaeb74ae9318252829c59a84a7d2316fc335660 affected
f4e44b393389c77958f7c58bf4415032b4cda15b< 0fccf5f01ed28725cc313a66ca1247eef911d55e affected
f4e44b393389c77958f7c58bf4415032b4cda15b< a97668ec6d73dab237cd1c15efe012a10090a4ed affected
f4e44b393389c77958f7c58bf4415032b4cda15b< 5060e1a5fef184bd11d298e3f0ee920d96a23236 affected
f4e44b393389c77958f7c58bf4415032b4cda15b< d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0 affected
f4e44b393389c77958f7c58bf4415032b4cda15b< 83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64 affected
f4e44b393389c77958f7c58bf4415032b4cda15b< b31da62889e6d610114d81dc7a6edbcaa503fcf8 affected
5.10.220< 5.10.239 affected
… +9 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38231

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nfsd: Initialize ssc before laundromat_work to prevent NULL dereference
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized, this can cause NULL pointer dereference. Normally the delayed start of laundromat_work allows sufficient time for nfsd_ssc initialization to complete. However, when the kernel waits too long for userspace responses (e.g. in nfs4_state_start_net -> nfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done -> cld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the delayed work may start before nfsd_ssc initialization finishes. Fix this by moving nfsd_ssc initialization before starting laundromat_work.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nfsd未正确初始化ssc导致laundromat_work空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a4bc287943f5695209ff36bdc89f17b48d68fae7 ~ deaeb74ae9318252829c59a84a7d2316fc335660 -
Linux Linux 5.14 -

II. Public POCs for CVE-2025-38231

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38231

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-38231 (2)

Same Patch Batch · Linux · 2025-07-04 · 59 CVEs total

CVE-2025-38209 9.8 CRITICAL nvme-tcp: remove tag set when second admin queue config fails
CVE-2025-38211 9.8 CRITICAL RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction
CVE-2025-38174 8.8 HIGH thunderbolt: Do not double dequeue a configuration request
CVE-2025-38216 8.8 HIGH iommu/vt-d: Restore context entry setup order for aliased devices
CVE-2025-38233 7.8 HIGH powerpc64/ftrace: fix clobbered r15 during livepatching
CVE-2025-38230 7.8 HIGH jfs: validate AG parameters in dbMount() to prevent crashes
CVE-2025-38227 7.8 HIGH media: vidtv: Terminating the subsequent process of initialization failure
CVE-2025-38226 7.8 HIGH media: vivid: Change the siize of the composing
CVE-2025-38224 7.8 HIGH can: kvaser_pciefd: refine error prone echo_skb_max handling logic
CVE-2025-38218 7.8 HIGH f2fs: fix to do sanity check on sit_bitmap_size
CVE-2025-38232 7.8 HIGH NFSD: fix race between nfsd registration and exports_proc
CVE-2025-38212 7.8 HIGH ipc: fix to protect IPCS lookups using RCU
CVE-2025-38175 7.8 HIGH binder: fix yet another UAF in binder_devices
CVE-2025-38234 7.8 HIGH sched/rt: Fix race in push_rt_task
CVE-2025-38206 7.8 HIGH exfat: fix double free in delayed_free
CVE-2025-38204 7.8 HIGH jfs: fix array-index-out-of-bounds read in add_missing_indices
CVE-2025-38192 7.8 HIGH net: clear the dst when changing skb protocol
CVE-2025-38187 7.8 HIGH drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()
CVE-2025-38184 7.8 HIGH tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer
CVE-2025-38180 7.8 HIGH net: atm: fix /proc/net/atm/lec handling

Showing top 20 of 59 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38231

No comments yet

Leave a comment