CVE-2025-38232: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38232 is a race condition vulnerability in the Linux kernel's NFSD (Network File System Daemon) subsystem, specifically between NFSD module registration and the exports_proc interface. The flaw exists because create_proc_exports_entry() is called at the start of init_nfsd while cleanup via remove_proc_entry() occurs at the end of exit_nfsd, creating a window where the proc interface can be accessed while NFSD structures are still being initialized or torn down. Affected kernel versions include all releases before 6.12.35 and versions 6.13.x through 6.15.3. It was published on July 4, 2025, and carries a CVSS v3.1 base score of 4.7 (Medium) (Red Hat CVE, Feedly).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). The race is triggered when two concurrent operations occur: (1) exportfs -r refreshing NFS exports, which accesses the /proc/fs/nfsd/exports interface, and (2) mounting the NFSD filesystem via mount -t nfsd none /proc/fs/nfsd. Because the proc entry is registered before all NFSD internal structures (such as per-network-namespace data) are fully initialized, a concurrent open of the proc file can dereference a NULL pointer in exports_net_open() or cache_seq_next_rcu(). The fix reorders initialization and teardown so that userspace-facing interfaces are exported last and cleaned up first (Red Hat CVE, Kernel Patch).

Successful exploitation causes kernel NULL pointer dereferences and page faults, resulting in kernel panics (OOPs) and a complete denial of service on the affected host. The vulnerability has no confidentiality or integrity impact; availability is the sole concern, as the kernel crash brings down all services running on the system. The attack is local and requires low privileges, but no user interaction, making it feasible for any local user with access to NFSD and proc filesystem operations (Red Hat CVE, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Triggering the race condition requires local access and the ability to concurrently run exportfs -r and mount the NFSD filesystem, which limits the practical attack surface to multi-user or container environments where NFSD is in use.

1. Prerequisite: Obtain local access to a system running a vulnerable Linux kernel (< 6.12.35 or 6.13.x–6.15.3) with the NFSD module available.
2. Setup: Ensure the NFS server daemon (nfsd) module is not yet loaded or is in the process of being loaded/unloaded.
3. Trigger the race: Concurrently execute the following two operations in a tight loop or via parallel threads/scripts:
   • exportfs -r (refreshes NFS exports, accessing /proc/fs/nfsd/exports)
   • mount -t nfsd none /proc/fs/nfsd (mounts the NFSD proc filesystem, triggering init_nfsd)
4. Race window: If the proc entry is opened (via exports_proc_open) while nfsd_init_net() has not yet completed initializing per-namespace structures, a NULL pointer dereference occurs in exports_net_open() or cache_seq_next_rcu().
5. Result: The kernel crashes with an OOPs (NULL pointer dereference), causing a denial of service (Red Hat CVE, Feedly).

• Logs: Kernel OOPs messages in /var/log/kern.log or dmesg output referencing exports_net_open+0x50/0x68 [nfsd] or cache_seq_next_rcu with a NULL pointer dereference at virtual address 0x0000000000000010.
• Logs: Stack traces in kernel logs showing call chains through exports_proc_open, proc_reg_open, do_dentry_open, and vfs_open.
• Process: Repeated concurrent invocations of exportfs -r and mount -t nfsd none /proc/fs/nfsd visible in process listings or audit logs.
• System: Unexpected kernel panics or system reboots on NFS server hosts, particularly those running vulnerable kernel versions.

Update the Linux kernel to version 6.12.35 or later (for the 6.12.x branch), or to 6.15.4 or later (for the 6.13–6.15.x branch). Multiple stable-branch patches are available at git.kernel.org (Kernel Patch, Kernel Patch). Ubuntu has issued security notices (USN-7833-1 through USN-7833-4, USN-7856-1, USN-8162-1, USN-8180-x, USN-8186-1, USN-8188-1, USN-8243-1, USN-8275-1, USN-8297-1) and Debian has issued DLA-4476-1 addressing this issue. As a workaround until patching is possible, restrict local user access to NFSD operations and avoid concurrent exportfs -r and NFSD module mount/unmount operations in production environments (Red Hat CVE, Ubuntu USN-7833-1).

Red Hat has acknowledged the vulnerability and published a CVE advisory, rating it as Medium severity (Red Hat CVE). Ubuntu has issued multiple security notices across several kernel variants, and Debian has addressed it in LTS updates, reflecting broad downstream distribution response. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.