Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2025-68349

Опубликовано: 24 дек. 2025
Источник: redhat
CVSS3: 7.5
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout.

A flaw null pointer dereference in the Linux kernel NFS functionality was found in the way client does some specific action for existing NFS connection. A client user could use this flaw to crash the server system.

Отчет

This bug is caused by a stale state flag (NFS_INO_LAYOUTCOMMIT) remaining set after the pNFS layout has been invalidated, leading to a NULL pointer dereference during layout commit handling. The issue results in a kernel crash when specific NFS writeback paths are executed. As it involves no memory corruption or attacker-controlled data, it represents a denial-of-service condition only. The issue is triggered by a connected NFS client through normal pNFS writeback flows and affects the NFS server kernel, requiring an established NFSv4 session rather than unauthenticated network access.

Меры по смягчению последствий

If NFS service not being used, then disable it to prevent possibility of triggering this bug (and usually it is disabled by default): sudo systemctl stop nfs-server sudo systemctl disable nfs-server

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 6kernelOut of support scope
Red Hat Enterprise Linux 9kernel-rtAffected
Red Hat Enterprise Linux 10kernelFixedRHSA-2026:272116.02.2026
Red Hat Enterprise Linux 7 Extended Lifecycle Supportkernel-rtFixedRHSA-2026:363403.03.2026
Red Hat Enterprise Linux 7 Extended Lifecycle SupportkernelFixedRHSA-2026:368503.03.2026
Red Hat Enterprise Linux 8kernel-rtFixedRHSA-2026:237810.02.2026
Red Hat Enterprise Linux 8kernelFixedRHSA-2026:226409.02.2026
Red Hat Enterprise Linux 8.2 Advanced Update SupportkernelFixedRHSA-2026:266412.02.2026
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportkernelFixedRHSA-2026:336025.02.2026
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnkernelFixedRHSA-2026:336025.02.2026

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-476
https://bugzilla.redhat.com/show_bug.cgi?id=2424880kernel: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

EPSS

Процентиль: 16%
0.00053
Низкий

7.5 High

CVSS3

Связанные уязвимости

ubuntu
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout.

nvd
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout.

CVSS3: 4.7
msrc
3 месяца назад

NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

debian
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: N ...

github
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout.

EPSS

Процентиль: 16%
0.00053
Низкий

7.5 High

CVSS3