CVE-2025-38400

Q: What is the severity of CVE-2025-38400?

CVE-2025-38400 has a CVSS score of 5.5 (MEDIUM). This CVE describes a cleanup issue in the Linux kernel's NFS client where if nfs_fs_proc_net_init() fails during network namespace creation, the /proc/net/rpc/nfs directory is not properly removed. This leads to a kernel warning when rpc_proc_exit() later tries to remove the parent directory. The vulnerability affects Linux systems using NFS with network namespace functionality.

5.5 MEDIUM

📋 TL;DR

This CVE describes a cleanup issue in the Linux kernel's NFS client where if nfs_fs_proc_net_init() fails during network namespace creation, the /proc/net/rpc/nfs directory is not properly removed. This leads to a kernel warning when rpc_proc_exit() later tries to remove the parent directory. The vulnerability affects Linux systems using NFS with network namespace functionality.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated, but references suggest fixes in stable kernel trees.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires NFS client functionality and network namespace operations. The vulnerability was discovered through fault injection testing.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system instability if the warning triggers during critical operations, potentially causing denial of service.

🟠

Likely Case

Kernel warning messages in system logs during network namespace operations, with no direct security compromise.

🟢

If Mitigated

Minor system log pollution with warning messages, no functional impact.

🌐 Internet-Facing: LOW - Requires local access or specific network namespace operations.

🏢 Internal Only: LOW - Requires local access and specific failure conditions during NFS initialization.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires triggering specific failure conditions in nfs_fs_proc_net_init() during network namespace creation, which is complex and unlikely in normal operation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (commits referenced in CVE)

Vendor Advisory: https://git.kernel.org/stable/c/3c94212b57bedec3a386ef3da1ef00602f5c3d1d

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from official kernel.org or distribution vendor. 2. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable NFS client

linux

Remove NFS client functionality if not needed

modprobe -r nfs
echo 'blacklist nfs' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Monitor system logs for warning messages about 'removing non-empty directory'
Avoid unnecessary network namespace operations and unshare() system calls

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if NFS modules are loaded: lsmod | grep nfs && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is updated beyond patched commits and check /proc/net/rpc/nfs exists only when NFS is properly initialized

📡 Detection & Monitoring

Log Indicators:

Kernel warning: 'remove_proc_entry: removing non-empty directory 'net/rpc', leaking at least 'nfs'
FAULT_INJECTION messages in kernel logs

Network Indicators:

None specific - this is a local kernel issue

SIEM Query:

source="kernel" AND "removing non-empty directory" AND "net/rpc"

📊 Metadata

CVE ID: CVE-2025-38400

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.02% exploit probability (4th percentile)

Published: July 25, 2025

Last Updated: December 23, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable NFS client

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export