CVE-2025-68349

Vulnerability

Description

In the Linux kernel's NFSv4/pNFS implementation, a null pointer dereference vulnerability exists in the pnfs_mark_layout_stateid_invalid function. The root cause is that the NFS_INO_LAYOUTCOMMIT flag is not cleared when the layout stateid is marked invalid. This can lead to a situation where pnfs_layoutcommit_inode is called on a null layout pointer, causing a kernel crash. The issue manifests in the call stack write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode [1].

Exploitation

An attacker with the ability to trigger NFS write operations on a system using NFSv4 with pNFS (parallel NFS) can potentially exploit this vulnerability. The attack requires that the layout delegation and the ability to cause layout stateid invalidation. No authentication is needed beyond normal NFS client access. The vulnerability is triggered during normal write-back operations when the kernel attempts to commit a layout that has already been invalidated but still has the layoutcommit flag set.

Impact

Successful exploitation results in a kernel crash (denial of service) due to a null pointer dereference. This can cause system instability or complete system hang, requiring a reboot to recover. There is no evidence of privilege escalation or data corruption from the available information.

Mitigation

The fix is included in Linux kernel stable updates. Patches are available in commits [1], [2], and [3] for various stable kernel branches. System administrators should apply the latest kernel updates from their distribution. No workaround is available other than avoiding the use of NFSv4 pNFS layouts or applying the patch.