{"schema_version":"1.7.5","id":"CVE-2025-38231","published":"2025-07-04T13:37:44.978Z","modified":"2026-07-15T01:48:54.375891117Z","related":["SUSE-SU-2025:02853-1","SUSE-SU-2025:02923-1","SUSE-SU-2025:02969-1","SUSE-SU-2025:02996-1","SUSE-SU-2025:02997-1","SUSE-SU-2025:03011-1","SUSE-SU-2025:03023-1","SUSE-SU-2025:20577-1","SUSE-SU-2025:20586-1","SUSE-SU-2025:20601-1","SUSE-SU-2025:20602-1","SUSE-SU-2025:21074-1","SUSE-SU-2025:21139-1","SUSE-SU-2025:21179-1","SUSE-SU-2026:20560-1","openSUSE-SU-2025:20081-1"],"summary":"nfsd: Initialize ssc before laundromat_work to prevent NULL dereference","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Initialize ssc before laundromat_work to prevent NULL dereference\n\nIn nfs4_state_start_net(), laundromat_work may access nfsd_ssc through\nnfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized,\nthis can cause NULL pointer dereference.\n\nNormally the delayed start of laundromat_work allows sufficient time for\nnfsd_ssc initialization to complete. However, when the kernel waits too\nlong for userspace responses (e.g. in nfs4_state_start_net ->\nnfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done ->\ncld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the\ndelayed work may start before nfsd_ssc initialization finishes.\n\nFix this by moving nfsd_ssc initialization before starting laundromat_work.","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a4bc287943f5695209ff36bdc89f17b48d68fae7"},{"fixed":"deaeb74ae9318252829c59a84a7d2316fc335660"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f4e44b393389c77958f7c58bf4415032b4cda15b"},{"fixed":"0fccf5f01ed28725cc313a66ca1247eef911d55e"},{"fixed":"a97668ec6d73dab237cd1c15efe012a10090a4ed"},{"fixed":"5060e1a5fef184bd11d298e3f0ee920d96a23236"},{"fixed":"d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0"},{"fixed":"83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64"},{"fixed":"b31da62889e6d610114d81dc7a6edbcaa503fcf8"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.220"},{"fixed":"5.10.239"}]}],"versions":["v5.10.238","v5.10.237","v5.10.236","v5.10.235","v5.10.234","v5.10.233","v5.10.232","v5.10.231","v5.10.230","v5.10.229","v5.10.228","v5.10.227","v5.10.226","v5.10.225","v5.10.224","v5.10.223","v5.10.222","v5.10.221","v5.10.220"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38231.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.239"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.186"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.14.0"},{"fixed":"6.1.142"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.6.95"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.12.35"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.15.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38231.json"}}],"references":[{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"type":"WEB","url":"https://git.kernel.org/stable/c/0fccf5f01ed28725cc313a66ca1247eef911d55e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5060e1a5fef184bd11d298e3f0ee920d96a23236"},{"type":"WEB","url":"https://git.kernel.org/stable/c/83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a97668ec6d73dab237cd1c15efe012a10090a4ed"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b31da62889e6d610114d81dc7a6edbcaa503fcf8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0"},{"type":"WEB","url":"https://git.kernel.org/stable/c/deaeb74ae9318252829c59a84a7d2316fc335660"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38231.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38231"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38231.json"}}