CVE-2025-38023: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38023 is a NULL pointer dereference vulnerability in the Linux kernel's NFS (Network File System) client subsystem, specifically in the unlock path of the NFSv4 locking implementation. When memory is insufficient and nfs_get_lock_context() fails with -ENOMEM, the resulting error value is mistakenly treated as a valid nfs4_unlockdata structure pointer, causing a NULL pointer dereference in nfs4_locku_prepare when rpc_run_task() is subsequently called. The vulnerability affects Linux kernel versions from 4.12 through multiple stable branches, including versions before 5.4.294, 5.10.238, 5.15.184, 6.1.140, 6.6.92, 6.12.30, 6.14.8, and 6.15-rc series. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in the NFS kernel subsystem's lock release path. When nfs_get_lock_context() fails due to memory pressure and returns -ENOMEM (cast as a pointer), the calling code in the unlock path does not properly check for this error condition before proceeding to use the returned value as a valid nfs_lock_context pointer. The l_ctx member of the nfs4_unlockdata structure is set to this error pointer, and when rpc_run_task() is invoked, nfs4_locku_prepare attempts to dereference it, triggering a kernel oops at address 0x000000000000000c. The crash occurs in the rpciod workqueue context (kworker/u64:0), meaning it can be triggered under low-memory conditions during NFS file unlock operations (Feedly).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a kernel panic (oops) and system crash, leading to a complete denial of service for the affected host. The impact is limited to availability — there is no confidentiality or integrity impact. Systems acting as NFS clients that encounter memory pressure during file unlock operations are at risk, and the crash occurs in kernel context, affecting the entire system rather than a single process (Feedly).

No public exploit code or proof-of-concept has been identified for CVE-2025-38023. The vulnerability requires local access and low privileges to trigger, and exploitation depends on inducing memory allocation failure (-ENOMEM) during an NFS unlock operation — a condition that may occur naturally under memory pressure rather than through deliberate attack. The EPSS score is 0.024% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution or in-the-wild exploitation has been reported (Feedly).

• Logs/Kernel Messages: Kernel oops messages referencing nfs4_locku_prepare with a NULL pointer dereference at address 0x000000000000000c; stack traces involving rpc_async_schedule, rpciod workqueue, and NFS locking functions.
• Process Behavior: Unexpected system crashes or kernel panics on NFS client systems, particularly under memory pressure conditions during file unlock operations.
• System Events: Kernel crash dumps (vmcore) containing stack frames with nfs4_locku_prepare+0x35/0xc2 and rpc_run_task in the call chain.

The Linux kernel maintainers have released patches across all affected stable branches. Users should update to kernel versions 5.4.294, 5.10.238, 5.15.184, 6.1.140, 6.6.92, 6.12.30, or 6.14.8 or later, depending on their branch. Major distributions including Ubuntu (USN-7654-x, USN-7655-1, USN-7699-x, USN-7711-1, USN-7721-1), SUSE, Debian (DLA-4271-1, DLA-4327-1), Oracle Linux, and Amazon Linux 2 have all issued updated kernel packages. As a temporary workaround, avoiding NFS client usage under extreme memory pressure may reduce exposure, but applying the vendor-provided kernel update is the recommended remediation (Feedly, Ubuntu Advisory, Debian LTS).