CVE-2025-38691 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2025-38691?

CVE-2025-38691 has a CVSS score of 5.5 (MEDIUM). This CVE describes a use-after-free vulnerability in the Linux kernel's pNFS block/scsi layout code where uninitialized pointers in the 'layoutupdate_pages' array can be dereferenced during extent encoding retries. This affects Linux systems using pNFS with block or scsi layouts. The vulnerability can lead to kernel crashes or potential privilege escalation.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's pNFS block/scsi layout code where uninitialized pointers in the 'layoutupdate_pages' array can be dereferenced during extent encoding retries. This affects Linux systems using pNFS with block or scsi layouts. The vulnerability can lead to kernel crashes or potential privilege escalation.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE description, but patches are available in stable kernel trees.

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using pNFS with block or scsi layout drivers. Systems not using pNFS or using other layout types are not affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to kernel mode if combined with other vulnerabilities.

🟠

Likely Case

Kernel crash or system instability when pNFS operations encounter many extents without preallocation.

🟢

If Mitigated

System remains stable with proper patching or workarounds in place.

🌐 Internet-Facing: LOW - pNFS is typically used in internal storage networks, not directly internet-facing.

🏢 Internal Only: MEDIUM - Affects internal storage infrastructure using pNFS with block/scsi layouts.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires access to trigger pNFS operations with specific extent patterns. No public exploits known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (see references for specific commits)

Vendor Advisory: https://git.kernel.org/stable/c/24334f3cf8a294f253071b5bf22d754dbb6d0f2d

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution's repository. 2. Reboot the system to load the new kernel. 3. Verify the fix is applied by checking kernel version.

🔧 Temporary Workarounds

Disable pNFS block/scsi layouts

Linux

Temporarily disable pNFS block and scsi layout usage if not required

echo 0 > /sys/module/nfs/parameters/enable_legacy_disk
echo 0 > /sys/module/nfs/parameters/enable_scsi

🧯 If You Can't Patch

Avoid writing large files without preallocation on pNFS mounts
Monitor system logs for kernel panic or oops messages related to pNFS operations

🔍 How to Verify

Check if Vulnerable:

Check if system uses pNFS with block/scsi layouts and has unpatched kernel. Run: cat /proc/version | grep -E '4\.|5\.|6\.' to check kernel version.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version after update and check that pNFS operations complete without errors. Monitor dmesg for pNFS-related errors.

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages in dmesg
System crashes during file operations on pNFS mounts
pNFS-related error messages in system logs

Network Indicators:

Unusual NFS traffic patterns
Failed NFS operations

SIEM Query:

source="kernel" AND ("pNFS" OR "layoutupdate" OR "ext_tree") AND ("panic" OR "oops" OR "BUG")

📊 Metadata

CVE ID: CVE-2025-38691

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-908

EPSS Score: 0.01% exploit probability (2.3th percentile)

Published: September 4, 2025

Last Updated: January 9, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-38691, you might also want to check these: