VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 4, 2025· Updated Apr 15, 2026

CVE-2025-40237

CVE-2025-40237

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/notify: call exportfs_encode_fid with s_umount

Calling intotify_show_fdinfo() on fd watching an overlayfs inode, while the overlayfs is being unmounted, can lead to dereferencing NULL ptr.

This issue was found by syzkaller.

Race Condition Diagram:

Thread 1 Thread 2 -------- --------

generic_shutdown_super() shrink_dcache_for_umount sb->s_root = NULL

| | vfs_read() | inotify_fdinfo() | * inode get from mark * | show_mark_fhandle(m, inode) | exportfs_encode_fid(inode, ..) | ovl_encode_fh(inode, ..) | ovl_check_encode_origin(inode) | * deref i_sb->s_root * | | v fsnotify_sb_delete(sb)

Which then leads to:

[ 32.133461] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 32.134438] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 32.135032] CPU: 1 UID: 0 PID: 4468 Comm: systemd-coredum Not tainted 6.17.0-rc6 #22 PREEMPT(none)

[ 32.143353] Call Trace: [ 32.143732] ovl_encode_fh+0xd5/0x170 [ 32.144031] exportfs_encode_inode_fh+0x12f/0x300 [ 32.144425] show_mark_fhandle+0xbe/0x1f0 [ 32.145805] inotify_fdinfo+0x226/0x2d0 [ 32.146442] inotify_show_fdinfo+0x1c5/0x350 [ 32.147168] seq_show+0x530/0x6f0 [ 32.147449] seq_read_iter+0x503/0x12a0 [ 32.148419] seq_read+0x31f/0x410 [ 32.150714] vfs_read+0x1f0/0x9e0 [ 32.152297] ksys_read+0x125/0x240

IOW ovl_check_encode_origin derefs inode->i_sb->s_root, after it was set to NULL in the unmount path.

Fix it by protecting calling exportfs_encode_fid() from show_mark_fhandle() with s_umount lock.

This form of fix was suggested by Amir in [1].

[1]: https://lore.kernel.org/all/CAOQ4uxhbDwhb+2Brs1UdkoF0a3NSdBAOQPNfEHjahrgoKJpLEw@mail.gmail.com/

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Race condition in overlayfs inotify handling during unmount leads to NULL pointer dereference, fixed by protecting access with s_umount.

Vulnerability

Description In the Linux kernel, a race condition exists in the overlay filesystem (overlayfs) when handling inotify fdinfo during unmount. The issue occurs when one thread is unmounting the overlayfs, setting the superblock's root inode (s_root) to NULL via shrink_dcache_for_umount, while another thread reads from a file descriptor that triggers inotify_show_fdinfo(). This results in a NULL pointer dereference when ovl_check_encode_origin() attempts to dereference inode->i_sb->s_root, which has been set to NULL.

Exploitation

An attacker can trigger this exploit by having a process with an inotify watch on an overlayfs inode, and while the overlayfs is being unmounted, reading the corresponding file descriptor's fdinfo (e.g., via /proc/self/fdinfo/). This requires local access to trigger the unmount race. No special privileges are needed beyond the ability to read fdinfo for owned file descriptors.

Impact

Successful exploitation leads to a kernel crash (NULL pointer dereference), resulting in a denial of service (DoS) for the affected kernel instance. The crash is a general protection fault, as shown by the KASAN null-ptr-deref report.

Mitigation

The fix is available in the Linux kernel stable tree via commits [1] and [2], which protect the call to exportfs_encode_fid() with the s_umount lock to prevent the race. Users should apply the latest stable kernel updates to resolve this issue.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!

AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

5
950b604384fd
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
bc1c6b803e14
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
3f307a9f7a7a
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
d1894bc542be
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
a7c4bb43bfdc
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.