CVE-2025-38338

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()

Sometimes, when a file was read while it was being truncated by

another NFS client, the kernel could deadlock because folio_unlock()

was called twice, and the second call would XOR back the `PG_locked`

flag.

Most of the time (depending on the timing of the truncation), nobody

notices the problem because folio_unlock() gets called three times,

which flips `PG_locked` back off:

1. vfs_read, nfs_read_folio, ... nfs_read_add_folio,

nfs_return_empty_folio

2. vfs_read, nfs_read_folio, ... netfs_read_collection,

netfs_unlock_abandoned_read_pages

3. vfs_read, ... nfs_do_read_folio, nfs_read_add_folio,

nfs_return_empty_folio

The problem is that nfs_read_add_folio() is not supposed to unlock the

folio if fscache is enabled, and a nfs_netfs_folio_unlock() check is

missing in nfs_return_empty_folio().

Rarely this leads to a warning in netfs_read_co

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References