CVE-2025-68185

Vulnerability

In the Linux kernel, the function nfs4_setup_readdir() lacks proper locking when dereferencing the inode of the parent directory (->d_parent->d_inode). This insufficient locking can theoretically lead to a race condition, potentially resulting in a kernel oops if the parent directory's inode is accessed concurrently and becomes invalid or changed.

Exploitation

The race is considered difficult to exploit on real hardware, though it may become more feasible in virtualized environments such as KVM. The attack requires precise timing and likely local access to trigger the race. No authentication is needed beyond the ability to perform NFS directory reads that invoke the vulnerable code path.

Impact

If successfully triggered, an attacker could cause a kernel panic (oops), leading to denial of service. Given the theoretical nature and difficulty of exploitation, the practical risk is low, but the vulnerability is still addressed in kernel stable updates.

Mitigation

The fix is straightforward: by wrapping the dereference and subsequent xdr_encode_hyper() call under ->d_lock, the race is eliminated. Patches have been applied to the stable kernel tree as commit [1] and backported to various stable branches. Users should update to the latest stable kernel to mitigate this issue.