CVE-2025-38400: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38400 is a resource cleanup vulnerability in the Linux kernel's NFS (Network File System) module, specifically in the nfs_fs_proc_net_init() function. When this function fails, the /proc/net/rpc/nfs procfs directory is not properly removed, causing a kernel warning when rpc_proc_exit() later attempts to remove the non-empty /proc/net/rpc parent directory. The vulnerability was published on July 25, 2025, and affects multiple Linux kernel stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access with low privileges (Feedly).

The root cause is improper error handling (CWE-459: Incomplete Cleanup) in fs/nfs/client.c within the nfs_net_init() function, which calls nfs_fs_proc_net_init() but does not clean up the /proc/net/rpc/nfs entry on failure. This was discovered via syzbot fault injection targeting failslab in the kernel memory allocator, which triggered the failure path during network namespace creation (copy_net_ns → setup_net → ops_init → nfs_net_init). The bug manifests as a kernel warning when rpc_proc_exit() attempts to remove /proc/net/rpc while it still contains the orphaned nfs subdirectory. Exploitation requires local access to trigger namespace operations under fault conditions (Feedly).

The vulnerability's primary impact is on availability — it can cause system instability, kernel warnings, and resource leaks during network namespace operations. Repeated triggering may result in accumulation of orphaned procfs entries, degrading system performance or creating inconsistent kernel state. There is no confidentiality or integrity impact, and no known path to privilege escalation or lateral movement from this vulnerability alone (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating very low probability of exploitation in the near term. Triggering the bug requires local access and the ability to create network namespaces under specific fault conditions (Feedly).

Patches have been released for all affected Linux kernel stable branches. Users should update to the following fixed versions or later: 5.4.296+, 5.10.240+, 5.15.187+, 6.1.144+, 6.6.97+, 6.12.37+, or 6.15.6+. Downstream distributions including Ubuntu (USN-7774-x, USN-7775-x, USN-7834-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2025-084, ALAS2KERNEL-5.10-2025-101), Oracle Linux 8, Red Hat (RHSA-2026:18587), and AlmaLinux have issued their own kernel update advisories. No configuration-based workaround is available; upgrading the kernel is the recommended remediation (Ubuntu Advisory, AWS Advisory, Red Hat Advisory).