{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-38028",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-04-16T04:51:23.978Z",
        "datePublished": "2025-06-18T09:28:33.184Z",
        "dateUpdated": "2026-08-05T11:59:03.121Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T11:59:03.121Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS/localio: Fix a race in nfs_local_open_fh()\n\nOnce the clp->cl_uuid.lock has been dropped, another CPU could come in\nand free the struct nfsd_file that was just added. To prevent that from\nhappening, take the RCU read lock before dropping the spin lock."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The vulnerable code is the NFS client LOCALIO fast path, reached by ordinary read/write/commit syscalls against a mounted NFS filesystem (nfs_generic_pg_pgios and nfs_initiate_commit both call nfs_local_open_fh). LOCALIO by definition requires the nfsd server to be on the same host, so there is no remote packet path to this code.\nAC:L - The attacker controls both sides of the race: one set of threads issues concurrent I/O to enter nfs_local_open_fh, while another forces nfs_localio_disable_client()/nfs_uuid_put() to free the cached nfsd_file (via -ENOMEM/-ENXIO/-ENOENT from __nfs_local_open_fh or -EAGAIN from nfs_local_doio). The window is repeatedly retriable at will and widened by preemption under CPU pressure.\nPR:L - Any unprivileged local user with access to files on a LOCALIO-enabled NFS mount can drive both sides purely with read/write/close syscalls; no capability check exists anywhere along nfs_generic_pg_pgios → nfs_local_open_fh. The mount itself is a deployment precondition rather than a privilege the attacker must hold.\nUI:N - The attacker triggers the race entirely from their own concurrent threads; no victim action is needed once the localio mount exists.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - If the freed nfsd_file slot is reallocated, nfs_local_open_fh returns a pointer to a different live nfsd_file whose nf_file is then used for the NFS read, disclosing the contents of an unrelated file on the exported filesystem; more generally a UAF on the slab yields an arbitrary-read primitive.\nI:H - refcount_inc_not_zero() writes into freed/reallocated memory, and the returned stale nfsd_file is used for write_iter, corrupting a different file's data as well as another object's refcount, which enables a follow-on premature free and control-flow hijack.\nA:H - Use-after-free on the nfsd_file slab causes refcount warnings, slab corruption and oops/panic, and the corrupted refcount leads to a second premature free of a live nfsd_file — a repeatable local denial of service."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/nfs/localio.c"
                    ],
                    "versions": [
                        {
                            "version": "86e00412254a717ffd5d38dc5ec0ee1cce6281b3",
                            "lessThan": "185a2f2ddabdcf999823f61de67f86376883920d",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "86e00412254a717ffd5d38dc5ec0ee1cce6281b3",
                            "lessThan": "fa7ab64f1e2fdc8f2603aab8e0dd20de89cb10d9",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/nfs/localio.c"
                    ],
                    "versions": [
                        {
                            "version": "6.14",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.14",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.14.8",
                            "lessThanOrEqual": "6.14.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.15",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "6.14.8"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.14",
                                    "versionEndExcluding": "6.15"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/185a2f2ddabdcf999823f61de67f86376883920d"
                },
                {
                    "url": "https://git.kernel.org/stable/c/fa7ab64f1e2fdc8f2603aab8e0dd20de89cb10d9"
                }
            ],
            "title": "NFS/localio: Fix a race in nfs_local_open_fh()",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}