In the Linux kernel, the following vulnerability has been resolved:
pNFS: Fix uninited ptr deref in block/scsi layout
The error occurs on the third attempt to encode extents. When function exttreepreparecommit() reallocates a larger buffer to retry encoding extents, the "layoutupdatepages" page array is initialized only after the retry loop. But exttreefree_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers.
An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server.
During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in exttreeencodecommit() does not help much. Since this number increases even more between unlocking and locking of exttree, the reallocated buffer may not be large enough again and again.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24334f3cf8a294f253071b5bf22d754dbb6d0f2d",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"149786926277268124978478827593939923164",
"256244970761278757812146197919261151392",
"39708649793795765370078837381377686976",
"136448138457518332604492107594471390499",
"174135849502373743345926939633748989580",
"163796835101246129454631776783267631314",
"172444545719770254708168137414871038398",
"327563079436272263597887452590293777378",
"130277297828269785768689051546103677078",
"94911448243385135334298172481126010703",
"280053050830117547748412633515154090725",
"156388496343088598665866961994408792320",
"45905446078524089278890341614424778817",
"78471621164344406998098670850324571440",
"24302350553338030527332171810719871132",
"258927040696163825842443697768129807304",
"133692595387438867415488290855763707865",
"211925879573711526081841797624220900706",
"45800438415214437831160524220999193728"
]
},
"signature_version": "v1",
"id": "CVE-2025-38691-063f537f",
"signature_type": "Line",
"target": {
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9be5c04beca3202d0a5f09fb4b2ecb644caa0bc5",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"149786926277268124978478827593939923164",
"256244970761278757812146197919261151392",
"39708649793795765370078837381377686976",
"136448138457518332604492107594471390499",
"174135849502373743345926939633748989580",
"163796835101246129454631776783267631314",
"172444545719770254708168137414871038398",
"327563079436272263597887452590293777378",
"130277297828269785768689051546103677078",
"94911448243385135334298172481126010703",
"280053050830117547748412633515154090725",
"156388496343088598665866961994408792320",
"45905446078524089278890341614424778817",
"78471621164344406998098670850324571440",
"24302350553338030527332171810719871132",
"258927040696163825842443697768129807304",
"133692595387438867415488290855763707865",
"211925879573711526081841797624220900706",
"45800438415214437831160524220999193728"
]
},
"signature_version": "v1",
"id": "CVE-2025-38691-0846af02",
"signature_type": "Line",
"target": {
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9768797c219326699778fba9cd3b607b2f1e7950",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"149786926277268124978478827593939923164",
"256244970761278757812146197919261151392",
"39708649793795765370078837381377686976",
"136448138457518332604492107594471390499",
"174135849502373743345926939633748989580",
"163796835101246129454631776783267631314",
"172444545719770254708168137414871038398",
"327563079436272263597887452590293777378",
"130277297828269785768689051546103677078",
"94911448243385135334298172481126010703",
"280053050830117547748412633515154090725",
"156388496343088598665866961994408792320",
"45905446078524089278890341614424778817",
"78471621164344406998098670850324571440",
"24302350553338030527332171810719871132",
"258927040696163825842443697768129807304",
"133692595387438867415488290855763707865",
"211925879573711526081841797624220900706",
"45800438415214437831160524220999193728"
]
},
"signature_version": "v1",
"id": "CVE-2025-38691-1264af6e",
"signature_type": "Line",
"target": {
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37c3443a2685528f972d910a6fb87716b96fef46",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"149786926277268124978478827593939923164",
"256244970761278757812146197919261151392",
"39708649793795765370078837381377686976",
"136448138457518332604492107594471390499",
"174135849502373743345926939633748989580",
"163796835101246129454631776783267631314",
"172444545719770254708168137414871038398",
"327563079436272263597887452590293777378",
"130277297828269785768689051546103677078",
"94911448243385135334298172481126010703",
"280053050830117547748412633515154090725",
"156388496343088598665866961994408792320",
"45905446078524089278890341614424778817",
"78471621164344406998098670850324571440",
"24302350553338030527332171810719871132",
"258927040696163825842443697768129807304",
"133692595387438867415488290855763707865",
"211925879573711526081841797624220900706",
"45800438415214437831160524220999193728"
]
},
"signature_version": "v1",
"id": "CVE-2025-38691-1a50a5c7",
"signature_type": "Line",
"target": {
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2896f101110076ac6bf99d7aaf463d61e26f89dd",
"deprecated": false,
"digest": {
"function_hash": "282816555259294554714125405928158826343",
"length": 1373.0
},
"signature_version": "v1",
"id": "CVE-2025-38691-202624a5",
"signature_type": "Function",
"target": {
"function": "ext_tree_prepare_commit",
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0b2eee3fbba9b7e3746ef698424ef5e4a197776",
"deprecated": false,
"digest": {
"function_hash": "282816555259294554714125405928158826343",
"length": 1373.0
},
"signature_version": "v1",
"id": "CVE-2025-38691-28ac20fa",
"signature_type": "Function",
"target": {
"function": "ext_tree_prepare_commit",
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f783333cbfa2ee7d4aa8e47f6bd1b3f77534fcf",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"149786926277268124978478827593939923164",
"256244970761278757812146197919261151392",
"39708649793795765370078837381377686976",
"136448138457518332604492107594471390499",
"174135849502373743345926939633748989580",
"163796835101246129454631776783267631314",
"172444545719770254708168137414871038398",
"327563079436272263597887452590293777378",
"130277297828269785768689051546103677078",
"94911448243385135334298172481126010703",
"280053050830117547748412633515154090725",
"156388496343088598665866961994408792320",
"45905446078524089278890341614424778817",
"78471621164344406998098670850324571440",
"24302350553338030527332171810719871132",
"258927040696163825842443697768129807304",
"133692595387438867415488290855763707865",
"211925879573711526081841797624220900706",
"45800438415214437831160524220999193728"
]
},
"signature_version": "v1",
"id": "CVE-2025-38691-31f455c6",
"signature_type": "Line",
"target": {
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24334f3cf8a294f253071b5bf22d754dbb6d0f2d",
"deprecated": false,
"digest": {
"function_hash": "282816555259294554714125405928158826343",
"length": 1373.0
},
"signature_version": "v1",
"id": "CVE-2025-38691-3a611c87",
"signature_type": "Function",
"target": {
"function": "ext_tree_prepare_commit",
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94ec6d939031a616474376dadbf4a8d0ef8b0bcc",
"deprecated": false,
"digest": {
"function_hash": "282816555259294554714125405928158826343",
"length": 1373.0
},
"signature_version": "v1",
"id": "CVE-2025-38691-3e785cc6",
"signature_type": "Function",
"target": {
"function": "ext_tree_prepare_commit",
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2896f101110076ac6bf99d7aaf463d61e26f89dd",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"149786926277268124978478827593939923164",
"256244970761278757812146197919261151392",
"39708649793795765370078837381377686976",
"136448138457518332604492107594471390499",
"174135849502373743345926939633748989580",
"163796835101246129454631776783267631314",
"172444545719770254708168137414871038398",
"327563079436272263597887452590293777378",
"130277297828269785768689051546103677078",
"94911448243385135334298172481126010703",
"280053050830117547748412633515154090725",
"156388496343088598665866961994408792320",
"45905446078524089278890341614424778817",
"78471621164344406998098670850324571440",
"24302350553338030527332171810719871132",
"258927040696163825842443697768129807304",
"133692595387438867415488290855763707865",
"211925879573711526081841797624220900706",
"45800438415214437831160524220999193728"
]
},
"signature_version": "v1",
"id": "CVE-2025-38691-4b6fae2a",
"signature_type": "Line",
"target": {
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@94ec6d939031a616474376dadbf4a8d0ef8b0bcc",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"149786926277268124978478827593939923164",
"256244970761278757812146197919261151392",
"39708649793795765370078837381377686976",
"136448138457518332604492107594471390499",
"174135849502373743345926939633748989580",
"163796835101246129454631776783267631314",
"172444545719770254708168137414871038398",
"327563079436272263597887452590293777378",
"130277297828269785768689051546103677078",
"94911448243385135334298172481126010703",
"280053050830117547748412633515154090725",
"156388496343088598665866961994408792320",
"45905446078524089278890341614424778817",
"78471621164344406998098670850324571440",
"24302350553338030527332171810719871132",
"258927040696163825842443697768129807304",
"133692595387438867415488290855763707865",
"211925879573711526081841797624220900706",
"45800438415214437831160524220999193728"
]
},
"signature_version": "v1",
"id": "CVE-2025-38691-60fcb40b",
"signature_type": "Line",
"target": {
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9768797c219326699778fba9cd3b607b2f1e7950",
"deprecated": false,
"digest": {
"function_hash": "282816555259294554714125405928158826343",
"length": 1373.0
},
"signature_version": "v1",
"id": "CVE-2025-38691-8239c40d",
"signature_type": "Function",
"target": {
"function": "ext_tree_prepare_commit",
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37c3443a2685528f972d910a6fb87716b96fef46",
"deprecated": false,
"digest": {
"function_hash": "282816555259294554714125405928158826343",
"length": 1373.0
},
"signature_version": "v1",
"id": "CVE-2025-38691-8f5cdc11",
"signature_type": "Function",
"target": {
"function": "ext_tree_prepare_commit",
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f783333cbfa2ee7d4aa8e47f6bd1b3f77534fcf",
"deprecated": false,
"digest": {
"function_hash": "282816555259294554714125405928158826343",
"length": 1373.0
},
"signature_version": "v1",
"id": "CVE-2025-38691-9dfa057e",
"signature_type": "Function",
"target": {
"function": "ext_tree_prepare_commit",
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9be5c04beca3202d0a5f09fb4b2ecb644caa0bc5",
"deprecated": false,
"digest": {
"function_hash": "282816555259294554714125405928158826343",
"length": 1373.0
},
"signature_version": "v1",
"id": "CVE-2025-38691-a2bb42b5",
"signature_type": "Function",
"target": {
"function": "ext_tree_prepare_commit",
"file": "fs/nfs/blocklayout/extent_tree.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0b2eee3fbba9b7e3746ef698424ef5e4a197776",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"149786926277268124978478827593939923164",
"256244970761278757812146197919261151392",
"39708649793795765370078837381377686976",
"136448138457518332604492107594471390499",
"174135849502373743345926939633748989580",
"163796835101246129454631776783267631314",
"172444545719770254708168137414871038398",
"327563079436272263597887452590293777378",
"130277297828269785768689051546103677078",
"94911448243385135334298172481126010703",
"280053050830117547748412633515154090725",
"156388496343088598665866961994408792320",
"45905446078524089278890341614424778817",
"78471621164344406998098670850324571440",
"24302350553338030527332171810719871132",
"258927040696163825842443697768129807304",
"133692595387438867415488290855763707865",
"211925879573711526081841797624220900706",
"45800438415214437831160524220999193728"
]
},
"signature_version": "v1",
"id": "CVE-2025-38691-b843d895",
"signature_type": "Line",
"target": {
"file": "fs/nfs/blocklayout/extent_tree.c"
}
}
]