{"id":"CVE-2025-38231","title":"nfsd: Initialize ssc before laundromat_work to prevent NULL dereference","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Initialize ssc before laundromat_work to prevent NULL dereference\n\nIn nfs4_state_start_net(), laundromat_work may access nfsd_ssc through\nnfs4_laundromat -> nfsd4…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= a4bc287943f5695209ff36bdc89f17b48d68fae7 < deaeb74ae9318252829c59a84a7d2316fc335660","Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 0fccf5f01ed28725cc313a66ca1247eef911d55e","Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < a97668ec6d73dab237cd1c15efe012a10090a4ed","Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 5060e1a5fef184bd11d298e3f0ee920d96a23236","Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0","Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64","Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < b31da62889e6d610114d81dc7a6edbcaa503fcf8","Linux >= 5.10.220 < 5.10.239","Linux 5.14"],"published":"2025-07-04","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:06:53.634Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38231","references":[{"url":"https://git.kernel.org/stable/c/deaeb74ae9318252829c59a84a7d2316fc335660"},{"url":"https://git.kernel.org/stable/c/0fccf5f01ed28725cc313a66ca1247eef911d55e"},{"url":"https://git.kernel.org/stable/c/a97668ec6d73dab237cd1c15efe012a10090a4ed"},{"url":"https://git.kernel.org/stable/c/5060e1a5fef184bd11d298e3f0ee920d96a23236"},{"url":"https://git.kernel.org/stable/c/d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0"},{"url":"https://git.kernel.org/stable/c/83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64"},{"url":"https://git.kernel.org/stable/c/b31da62889e6d610114d81dc7a6edbcaa503fcf8"}],"tags":["cve.org"],"epss":0.00184,"epssPercentile":0.07939,"ingestedAt":"2026-10-15T05:52:46.092Z","slug":"CVE-2025-38231","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Initialize ssc before laundromat_work to prevent NULL dereference\n\nIn nfs4_state_start_net(), laundromat_work may access nfsd_ssc through\nnfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized,\nthis can cause NULL pointer dereference.\n\nNormally the delayed start of laundromat_work allows sufficient time for\nnfsd_ssc initialization to complete. However, when the kernel waits too\nlong for userspace responses (e.g. in nfs4_state_start_net ->\nnfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done ->\ncld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the\ndelayed work may start before nfsd_ssc initialization finishes.\n\nFix this by moving nfsd_ssc initialization before starting laundromat_work.\n\n## Affected\n\n- `Linux >= a4bc287943f5695209ff36bdc89f17b48d68fae7 < deaeb74ae9318252829c59a84a7d2316fc335660`\n- `Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 0fccf5f01ed28725cc313a66ca1247eef911d55e`\n- `Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < a97668ec6d73dab237cd1c15efe012a10090a4ed`\n- `Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 5060e1a5fef184bd11d298e3f0ee920d96a23236`\n- `Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0`\n- `Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < 83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64`\n- `Linux >= f4e44b393389c77958f7c58bf4415032b4cda15b < b31da62889e6d610114d81dc7a6edbcaa503fcf8`\n- `Linux >= 5.10.220 < 5.10.239`\n- `Linux 5.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}