CVE-2025-68349: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68349 is a null pointer dereference vulnerability in the Linux kernel's NFSv4/pNFS (Parallel NFS) subsystem. The flaw occurs because the NFS_INO_LAYOUTCOMMIT flag is not cleared in pnfs_mark_layout_stateid_invalid, allowing the kernel to attempt to dereference a null layout pointer during the write_inode → nfs4_write_inode → pnfs_layoutcommit_inode call stack. It was published on December 24, 2025, and affects Linux kernel versions from 4.10 up to the patched releases, with specific impact confirmed on Microsoft Azure Linux 3 kernels azl3_kernel_6.6.119.3-3 and azl3_kernel_6.6.117.1-1. The CVSS v3.1 base score is 4.7 (Medium) (Feedly, Microsoft MSRC).

The root cause is a missing flag clear operation classified as CWE-476 (NULL Pointer Dereference). The pnfs_set_layoutcommit function relies on the layout segment (lseg) reference count to keep the layout object alive; however, when pnfs_mark_layout_stateid_invalid invalidates the layout stateid without clearing NFS_INO_LAYOUTCOMMIT, a subsequent call to pnfs_layoutcommit_inode during inode writeback can attempt to access a layout pointer that has already been freed or set to null. Exploitation requires local access with low privileges and high attack complexity, as the race condition must be triggered during specific NFS write operations (Feedly). Patches are available in the Linux kernel stable repositories at commits 59947dff, ca2e7fda, 38694f9a, and e0f8058f (EUVD).

Successful exploitation causes a kernel crash (panic), resulting in a denial of service — the affected system becomes unavailable until rebooted. The vulnerability has no impact on confidentiality or integrity; only system availability is affected. In environments running NFS-backed workloads (e.g., cloud or HPC clusters using pNFS), a crash could disrupt all services on the affected node and potentially impact dependent workloads (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, and high attack complexity, significantly limiting the practical attack surface.

Apply the available kernel patches immediately. The vulnerability has been resolved in Linux kernel versions 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1 (EUVD). Downstream distributions have also issued updates: Red Hat (RHSA-2026:2264, RHSA-2026:2352, RHSA-2026:2378, and others), Debian (linux 6.1.162-1), Ubuntu (USN-8179-x, USN-8184-1, USN-8185-x, USN-8203-1, USN-8258-1, USN-8260-1, USN-8265-1), Amazon Linux 2, SUSE, AlmaLinux, and Rocky Linux have all released fixes (Feedly). As a workaround where patching is not immediately possible, restrict local user privileges and avoid exposing pNFS-enabled NFS mounts to untrusted users.