{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38089", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.982Z", "datePublished": "2025-06-30T07:29:44.836Z", "dateUpdated": "2026-08-05T11:59:25.591Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:25.591Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsunrpc: handle SVC_GARBAGE during svc auth processing as auth error\n\ntianshuo han reported a remotely-triggerable crash if the client sends a\nkernel RPC server a specially crafted packet. If decoding the RPC reply\nfails in such a way that SVC_GARBAGE is returned without setting the\nrq_accept_statp pointer, then that pointer can be dereferenced and a\nvalue stored there.\n\nIf it's the first time the thread has processed an RPC, then that\npointer will be set to NULL and the kernel will crash. In other cases,\nit could create a memory scribble.\n\nThe server sunrpc code treats a SVC_GARBAGE return from svc_authenticate\nor pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531\nsays that if authentication fails that the RPC should be rejected\ninstead with a status of AUTH_ERR.\n\nHandle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of\nAUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This\nsidesteps the whole problem of touching the rpc_accept_statp pointer in\nthis situation and avoids the crash." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The bug is in the shared kernel RPC server core (net/sunrpc/svc.c) used by nfsd, lockd, and the NFS callback service, and is triggered purely by the bytes of an inbound RPC call arriving on TCP/UDP 2049. Any host that can reach the listening socket, including across the internet, can send the malformed record.\nAC:L - The attacker sends a single truncated RPC message that ends before the credential flavor field; decode failure and the bad store are deterministic, with no race and no memory-layout precondition. Fresh nfsd threads (server start or pool growth) give the NULL-pointer variant reliably, and every other thread yields the write-after-free variant.\nPR:N - The crash occurs inside svc_authenticate() itself, before any credential is decoded and long before svc_set_client()/export checks, so no RPC credential, mount, or account is needed. A bare TCP connect to the RPC port is sufficient.\nUI:N - The server processes the malformed RPC automatically on receipt. No action by any local user or administrator is involved.\nS:U - The faulting store and its consequences are confined to the kernel's own memory and the RPC service; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - In the stale-pointer case this is a write into a freed and reallocated page, i.e. memory corruption of arbitrary kernel objects that can be groomed into that slot; corrupting a length or index field in a neighboring structure yields subsequent over-reads and disclosure of kernel memory.\nI:H - The vulnerable store writes a 32-bit value into a page that has already been released to the allocator and may hold any kernel object, at an offset the attacker can influence via the previous reply's verifier length. That is a remote pre-auth write-after-free primitive usable to corrupt pointers, credentials, or control data.\nA:H - The NULL-pointer variant oopses the nfsd kernel thread on the very first malformed RPC a thread sees, and can be repeated to kill the whole thread pool, taking down NFS service entirely (full panic where panic_on_oops is set). The write-after-free variant additionally causes unpredictable crashes in unrelated subsystems." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sunrpc/svc.c" ], "versions": [ { "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4", "lessThan": "599c489eea793821232a2f69a00fa57d82b0ac98", "status": "affected", "versionType": "git" }, { "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4", "lessThan": "353e75b55e583635bf71cde6abcec274dba05edd", "status": "affected", "versionType": "git" }, { "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4", "lessThan": "c90459cd58bb421d275337093d8e901e0ba748dd", "status": "affected", "versionType": "git" }, { "version": "29cd2927fb914cc53b5ba4f67d2b74695c994ba4", "lessThan": "94d10a4dba0bc482f2b01e39f06d5513d0f75742", "status": "affected", "versionType": "git" }, { "version": "9b59f5c4911e87264507e0934cd2bb277390c560", "status": "affected", "versionType": "git" }, { "version": "6.3.4", "lessThan": "6.4", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sunrpc/svc.c" ], "versions": [ { "version": "6.4", "status": "affected" }, { "version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.95", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.35", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.4", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.95" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.35" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.15.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/599c489eea793821232a2f69a00fa57d82b0ac98" }, { "url": "https://git.kernel.org/stable/c/353e75b55e583635bf71cde6abcec274dba05edd" }, { "url": "https://git.kernel.org/stable/c/c90459cd58bb421d275337093d8e901e0ba748dd" }, { "url": "https://git.kernel.org/stable/c/94d10a4dba0bc482f2b01e39f06d5513d0f75742" }, { "url": "https://www.openwall.com/lists/oss-security/2025/07/02/2" }, { "url": "https://github.com/keymaker-arch/NFSundown" } ], "title": "sunrpc: handle SVC_GARBAGE during svc auth processing as auth error", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "http://www.openwall.com/lists/oss-security/2025/07/02/2" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:10:10.064Z" } } ] } }