CVE-2025-38691

Root

Cause

In the Linux kernel's pNFS block/scsi layout driver, a bug in ext_tree_prepare_commit() leads to a use of uninitialized pointer on the third and subsequent attempts to encode extents. When a layout commit buffer is too small, the function reallocates a larger buffer, but the "layoutupdate_pages" page array is only initialized after the retry loop ends. However, ext_tree_free_commitdata() is called on every iteration and attempts to put pages in that array, dereferencing uninitialized pointers [1].

Attack

Vector & Prerequisites

An unprivileged local user can trigger this vulnerability by performing parallel, large-file writes without preallocation on a pNFS filesystem using block or SCSI layouts. The bug manifests when the number of extents grows large enough to require multiple buffer reallocations; the reallocated buffer may still be insufficient due to the number of written extents increasing between lock and unlock operations [1].

Impact

Successful exploitation results in a kernel use-after-free or pointer dereference from uninitialized memory. This can lead to a system crash (denial of service) or potentially allow local privilege escalation if an attacker can control the freed memory [1]. The vulnerability is rated Medium (CVSS 5.5) with a local attack vector and low privileges required.

Mitigation

The fix is included in upstream Linux kernel commits and should be applied to stable kernels [3][4]. No workaround is available; users must update their kernel to a version containing the patch. Siemens has confirmed that several of its industrial products (SIMATIC S7-1500 CPUs, ET 200 CPUs, SIPLUS variants, and SIMATIC CN 4100) are affected by this CVE and have issued specific advisory SSA-082556 [1] and SSA-032379 [2] with patch guidance.