CVE-2025-38393

4.7 MEDIUM

📋 TL;DR

This CVE describes a race condition vulnerability in the Linux kernel's NFSv4/pNFS implementation where improper synchronization between tasks waiting for layout operations can cause system hangs. It affects Linux systems using NFSv4 or pNFS for file sharing. The vulnerability can lead to denial of service conditions.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE; likely multiple stable kernel versions before the fix commits.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using NFSv4 or pNFS; NFSv3 and other filesystems are not affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system hang requiring hard reboot, with potential data loss or corruption in NFS-mounted filesystems.

🟠

Likely Case

Temporary system hangs or performance degradation affecting NFS operations until processes timeout or are killed.

🟢

If Mitigated

Minor performance impact or occasional NFS operation failures if proper monitoring and process management is in place.

🌐 Internet-Facing: LOW - Requires NFS access and specific race condition timing; not directly exploitable over internet without NFS exposure.

🏢 Internal Only: MEDIUM - Internal NFS clients/servers could experience hangs affecting business operations and data access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires triggering a specific race condition during NFS layout operations, making it difficult to reliably exploit.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 08287df60bac5b008b6bcdb03053988335d3d282, 1f4da20080718f258e189a2c5f515385fa393da6, 864a54c1243ed3ca60baa4bc492dede1361f4c83, 8846fd02c98da8b79e6343a20e6071be6f372180, 8ca65fa71024a1767a59ffbc6a6e2278af84735e

Vendor Advisory: https://git.kernel.org/stable/c/08287df60bac5b008b6bcdb03053988335d3d282

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution vendor for specific patched kernel versions. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable NFSv4/pNFS

linux

Use NFSv3 instead of NFSv4/pNFS if possible, as the vulnerability only affects NFSv4/pNFS implementations.

# In /etc/exports or NFS server configuration, use 'vers=3' instead of 'vers=4'
# Client mount with: mount -t nfs -o vers=3 server:/export /mnt

Monitor and kill hung processes

linux

Implement monitoring for hung NFS operations and manually kill affected processes.

# Check for processes stuck in D state: ps aux | awk '$8 ~ /D/'
# Check NFS operations: nfsstat -c
# Kill hung processes if identified

🧯 If You Can't Patch

Implement aggressive monitoring for system hangs and NFS operation failures with automated alerting.
Consider migrating critical NFS workloads to alternative storage solutions or using NFSv3 instead of NFSv4/pNFS.

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if NFSv4/pNFS is in use. Vulnerable if using affected kernel with NFSv4/pNFS.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits or check with distribution vendor for patched kernel version.

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing processes stuck in D state
NFS client/server logs showing timeouts or hung operations
System logs indicating high wait times or process blocking

Network Indicators:

Increased NFS operation timeouts
Unusual patterns of NFS retransmissions

SIEM Query:

source="kernel" AND ("D state" OR "hung" OR "blocked") AND ("nfs" OR "pNFS")

📊 Metadata

CVE ID: CVE-2025-38393

CVSS v3 Score: 4.7 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-362

EPSS Score: 0.01% exploit probability (2.3th percentile)

Published: July 25, 2025

Last Updated: December 23, 2025

🔗 References