CVE-2025-38023

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfs: handle failure of nfs_get_lock_context in unlock path

When memory is insufficient, the allocation of nfs_lock_context in

nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat

an nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM)

as valid and proceed to execute rpc_run_task(), this will trigger a NULL

pointer dereference in nfs4_locku_prepare. For example:

BUG: kernel NULL pointer dereference, address: 000000000000000c

PGD 0 P4D 0

Oops: Oops: 0000 [#1] SMP PTI

CPU: 15 UID: 0 PID: 12 Comm: kworker/u64:0 Not tainted 6.15.0-rc2-dirty #60

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40

Workqueue: rpciod rpc_async_schedule

RIP: 0010:nfs4_locku_prepare+0x35/0xc2

Code: 89 f2 48 89 fd 48 c7 c7 68 69 ef b5 53 48 8b 8e 90 00 00 00 48 89 f3

RSP: 0018:ffffbbafc006bdb8 EFLAGS: 00010246

RAX: 000000000000004b RBX: ffff9b964fc1fa00 RCX: 0000000000000000

RDX: 00000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References