CVE-2025-38028

A flaw was found in the Linux kernel's NFS/localio component. A race condition exists in the nfs_local_open_fh() function where a struct nfsd_file could be prematurely freed. A local attacker with low privileges could exploit this vulnerability, potentially leading to memory corruption. This could result in privilege escalation, information disclosure, or a denial of service.

A flaw was found in the Linux kernel's NFS localio support. A race condition exists in the nfs_local_open_fh() function: once the cl_uuid lock is dropped, a struct nfsd_file that was just added can be freed by another CPU while it is still in use, resulting in memory corruption. A local attacker with low privileges could exploit this race to cause a denial of service, and potentially achieve privilege escalation or information disclosure. Red Hat rated this flaw MODERATE (CVSS 4.7, AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) because successful exploitation requires high attack complexity and the expected practical impact is loss of availability, which is lower than the upstream CVE.org severity of IMPORTANT (7.8). The vulnerable NFS localio code was introduced into Red Hat Enterprise Linux 10, so only the RHEL 10 kernel streams are affected; Red Hat Enterprise Linux 6, 7, 8, and 9 (kernel and kernel-rt), Red Hat In-Vehicle OS, and Hosted OpenShift Clusters are not affected because the vulnerable code is not present. The affected RHEL 10 kernel streams are currently recorded with an out-of-support-scope (OOSS) resolution, so no fix is planned for them and the residual risk remains for deployments using NFS localio on those streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.