CVE-2025-38691

A null pointer dereference flaw in the Linux kernel pNFS driver was found in the way extent encoding retry logic handles its page array. A local user being NFS client can trigger this condition and cause this client machine to crash, resulting in a denial of service. The same path can also allow a layout commit to grow without an upper bound, which may reproduce RPC payloads larger than the server accepts (and server just ignores such requests, so still the problems only for client itself).

A bug in the pNFS block/SCSI client path allowed ext_tree_free_commitdata() to dereference entries of layoutupdate_pages before that array was initialized during repeated extent-encoding retries, causing a kernel crash on the NFS client. In addition, the buffer size could grow without a proper cap, risking over-large layoutcommit RPCs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the blockoutlayoutdriver module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.