In the Linux kernel, the following vulnerability has been resolved:
NFSv4/pNFS: Fix a race to wake on NFSLAYOUTDRAIN
We found a few different systems hung up in writeback waiting on the same page lock, and one task waiting on the NFSLAYOUTDRAIN bit in pnfsupdatelayout(), however the pnfslayouthdr's plh_outstanding count was zero.
It seems most likely that this is another race between the waiter and waker similar to commit ed0172af5d6f ("SUNRPC: Fix a race to wake a sync task"). Fix it up by applying the advised barrier.
[
{
"id": "CVE-2025-38393-0b1bdce7",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nfs/pnfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f4da20080718f258e189a2c5f515385fa393da6",
"signature_version": "v1",
"digest": {
"line_hashes": [
"58055677418615899087166675726809901381",
"251349712283302083257677454918560731107",
"27543768229993980459958628269266354449",
"164699399015347230184355947798703765436",
"200278966927434018900739127369977675756"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38393-1dd03cc5",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nfs/pnfs.c",
"function": "nfs_layoutget_end"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f4da20080718f258e189a2c5f515385fa393da6",
"signature_version": "v1",
"digest": {
"length": 201.0,
"function_hash": "304954259175494060862767405115975622766"
}
},
{
"id": "CVE-2025-38393-5aff9f02",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nfs/pnfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c01776287414ca43412d1319d2877cbad65444ac",
"signature_version": "v1",
"digest": {
"line_hashes": [
"58055677418615899087166675726809901381",
"251349712283302083257677454918560731107",
"27543768229993980459958628269266354449",
"164699399015347230184355947798703765436",
"200278966927434018900739127369977675756"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38393-c0de795a",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nfs/pnfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08287df60bac5b008b6bcdb03053988335d3d282",
"signature_version": "v1",
"digest": {
"line_hashes": [
"58055677418615899087166675726809901381",
"251349712283302083257677454918560731107",
"27543768229993980459958628269266354449",
"164699399015347230184355947798703765436",
"200278966927434018900739127369977675756"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38393-da2e7628",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "fs/nfs/pnfs.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ca65fa71024a1767a59ffbc6a6e2278af84735e",
"signature_version": "v1",
"digest": {
"line_hashes": [
"58055677418615899087166675726809901381",
"251349712283302083257677454918560731107",
"27543768229993980459958628269266354449",
"164699399015347230184355947798703765436",
"200278966927434018900739127369977675756"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38393-efb5b085",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nfs/pnfs.c",
"function": "nfs_layoutget_end"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08287df60bac5b008b6bcdb03053988335d3d282",
"signature_version": "v1",
"digest": {
"length": 201.0,
"function_hash": "304954259175494060862767405115975622766"
}
},
{
"id": "CVE-2025-38393-f44fd54a",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nfs/pnfs.c",
"function": "nfs_layoutget_end"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8ca65fa71024a1767a59ffbc6a6e2278af84735e",
"signature_version": "v1",
"digest": {
"length": 201.0,
"function_hash": "304954259175494060862767405115975622766"
}
},
{
"id": "CVE-2025-38393-fd982e94",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "fs/nfs/pnfs.c",
"function": "nfs_layoutget_end"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c01776287414ca43412d1319d2877cbad65444ac",
"signature_version": "v1",
"digest": {
"length": 201.0,
"function_hash": "304954259175494060862767405115975622766"
}
}
]