In the Linux kernel, the following vulnerability has been resolved:
NFSD: fix race between nfsd registration and exports_proc
As of now nfsd calls createprocexportsentry() at start of initnfsd and cleanup by removeprocentry() at last of exit_nfsd.
Which causes kernel OOPs if there is race between below 2 operations: (i) exportfs -r (ii) mount -t nfsd none /proc/fs/nfsd
for 5.4 kernel ARM64:
CPU 1: el1irq+0xbc/0x180 archcountergetcntvct+0x14/0x18 runningclock+0xc/0x18 preemptcountadd+0x88/0x110 prepnewpage+0xb0/0x220 getpagefromfreelist+0x2d8/0x1778 _allocpagesnodemask+0x15c/0xef0 _vmallocnoderange+0x28c/0x478 _vmallocnodeflagscaller+0x8c/0xb0 kvmallocnode+0x88/0xe0 nfsdinitnet+0x6c/0x108 [nfsd] opsinit+0x44/0x170 registerpernetoperations+0x114/0x270 registerpernetsubsys+0x34/0x50 initnfsd+0xa8/0x718 [nfsd] doone_initcall+0x54/0x2e0
CPU 2 : Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
PC is at : exportsnetopen+0x50/0x68 [nfsd]
Call trace: exportsnetopen+0x50/0x68 [nfsd] exportsprocopen+0x2c/0x38 [nfsd] procregopen+0xb8/0x198 dodentryopen+0x1c4/0x418 vfsopen+0x38/0x48 pathopenat+0x28c/0xf18 dofilpopen+0x70/0xe8 dosysopen+0x154/0x248
Sometimes it crashes at exportsnetopen() and sometimes cacheseqnext_rcu().
and same is happening on latest 6.14 kernel as well:
[ 0.000000] Linux version 6.14.0-rc5-next-20250304-dirty ... [ 285.455918] Unable to handle kernel paging request at virtual address 00001f4800001f48 ... [ 285.464902] pc : cacheseqnextrcu+0x78/0xa4 ... [ 285.469695] Call trace: [ 285.470083] cacheseqnextrcu+0x78/0xa4 (P) [ 285.470488] seqread+0xe0/0x11c [ 285.470675] procregread+0x9c/0xf0 [ 285.470874] vfsread+0xc4/0x2fc [ 285.471057] ksysread+0x6c/0xf4 [ 285.471231] _arm64sysread+0x1c/0x28 [ 285.471428] invokesyscall+0x44/0x100 [ 285.471633] el0svccommon.constprop.0+0x40/0xe0 [ 285.471870] doel0svccompat+0x1c/0x34 [ 285.472073] el0svccompat+0x2c/0x80 [ 285.472265] el0t32synchandler+0x90/0x140 [ 285.472473] el0t32_sync+0x19c/0x1a0 [ 285.472887] Code: f9400885 93407c23 937d7c27 11000421 (f86378a3) [ 285.473422] ---[ end trace 0000000000000000 ]---
It reproduced simply with below script: while [ 1 ] do /exportfs -r done &
while [ 1 ] do insmod /nfsd.ko mount -t nfsd none /proc/fs/nfsd umount /proc/fs/nfsd rmmod nfsd done &
So exporting interfaces to user space shall be done at last and cleanup at first place.
With change there is no Kernel OOPs.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"320764331418898662176523584476996292208",
"38322574981669666408282677529116980522",
"68725141622156201036190873283417567340",
"41696432336924140715742417027946660472",
"167295459117289318687874188079762726602",
"222912440347699456952672385187410476345",
"89443240824658701941654134650757784486",
"200917336753063556064394154914343968861",
"199660758282650071331770797526073427278",
"18461446218705694950575330761922446144",
"130504253762020770866134949158834827427",
"116951732821360904433569676573011343122",
"320560651482858139926002459384862334757",
"336634871906089620453856063755368587325",
"237737241116381897061622474943378970925",
"238558644307469722100981990470187922991",
"282194347163880719134675738326063541153",
"268909080849251881802203947804547484883",
"293701180929285736732970793795505791225",
"106960563037883862102701239744356557398",
"173881989195987164387578777591570634172",
"204992144528374920488269347790362503801",
"165384833752396803597626478729710241977",
"63266720671039816259254891601623638682",
"43978481589627570556701626518995588702",
"203744715813138301927372459193851037575",
"54982870927047490163750567414697108580",
"174752365799525365949692661560328003794",
"215689679865626186267958288693640527637",
"99982988456194551638773611998128176983",
"244402998776358305621050146706991280219",
"209750995026991485519037946427971962396",
"127153429239502956693621758012789667446",
"157431630597062825729137551540128086642",
"55973435962373769099498581755659190556",
"132784417984785056513108293607519094593"
]
},
"signature_type": "Line",
"target": {
"file": "fs/nfsd/nfsctl.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2029ca75cdfa6a25716a5a76b751486cce7e3822",
"id": "CVE-2025-38232-0956eda9"
},
{
"digest": {
"length": 981.0,
"function_hash": "267871751975664530243311897105431417940"
},
"signature_type": "Function",
"target": {
"function": "init_nfsd",
"file": "fs/nfsd/nfsctl.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7fb730cac9aafda8b9813b55d04e28a9664d17c",
"id": "CVE-2025-38232-21b8087e"
},
{
"digest": {
"length": 981.0,
"function_hash": "267871751975664530243311897105431417940"
},
"signature_type": "Function",
"target": {
"function": "init_nfsd",
"file": "fs/nfsd/nfsctl.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2029ca75cdfa6a25716a5a76b751486cce7e3822",
"id": "CVE-2025-38232-2896ff27"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"320764331418898662176523584476996292208",
"38322574981669666408282677529116980522",
"68725141622156201036190873283417567340",
"41696432336924140715742417027946660472",
"167295459117289318687874188079762726602",
"222912440347699456952672385187410476345",
"89443240824658701941654134650757784486",
"200917336753063556064394154914343968861",
"199660758282650071331770797526073427278",
"18461446218705694950575330761922446144",
"130504253762020770866134949158834827427",
"116951732821360904433569676573011343122",
"320560651482858139926002459384862334757",
"336634871906089620453856063755368587325",
"237737241116381897061622474943378970925",
"238558644307469722100981990470187922991",
"282194347163880719134675738326063541153",
"268909080849251881802203947804547484883",
"293701180929285736732970793795505791225",
"106960563037883862102701239744356557398",
"173881989195987164387578777591570634172",
"204992144528374920488269347790362503801",
"165384833752396803597626478729710241977",
"63266720671039816259254891601623638682",
"43978481589627570556701626518995588702",
"203744715813138301927372459193851037575",
"54982870927047490163750567414697108580",
"174752365799525365949692661560328003794",
"215689679865626186267958288693640527637",
"99982988456194551638773611998128176983",
"244402998776358305621050146706991280219",
"209750995026991485519037946427971962396",
"127153429239502956693621758012789667446",
"157431630597062825729137551540128086642",
"55973435962373769099498581755659190556",
"132784417984785056513108293607519094593"
]
},
"signature_type": "Line",
"target": {
"file": "fs/nfsd/nfsctl.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7fb730cac9aafda8b9813b55d04e28a9664d17c",
"id": "CVE-2025-38232-7279a6de"
},
{
"digest": {
"length": 287.0,
"function_hash": "223968638048689434569059555105074017056"
},
"signature_type": "Function",
"target": {
"function": "exit_nfsd",
"file": "fs/nfsd/nfsctl.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2029ca75cdfa6a25716a5a76b751486cce7e3822",
"id": "CVE-2025-38232-8f457163"
},
{
"digest": {
"length": 287.0,
"function_hash": "223968638048689434569059555105074017056"
},
"signature_type": "Function",
"target": {
"function": "exit_nfsd",
"file": "fs/nfsd/nfsctl.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7fb730cac9aafda8b9813b55d04e28a9664d17c",
"id": "CVE-2025-38232-a2bb4249"
},
{
"digest": {
"length": 981.0,
"function_hash": "267871751975664530243311897105431417940"
},
"signature_type": "Function",
"target": {
"function": "init_nfsd",
"file": "fs/nfsd/nfsctl.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@327011a2bb4f7de9c72b891a96ce8d902828bddf",
"id": "CVE-2025-38232-b97c9da5"
},
{
"digest": {
"length": 287.0,
"function_hash": "223968638048689434569059555105074017056"
},
"signature_type": "Function",
"target": {
"function": "exit_nfsd",
"file": "fs/nfsd/nfsctl.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@327011a2bb4f7de9c72b891a96ce8d902828bddf",
"id": "CVE-2025-38232-db3c948d"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"320764331418898662176523584476996292208",
"38322574981669666408282677529116980522",
"68725141622156201036190873283417567340",
"41696432336924140715742417027946660472",
"167295459117289318687874188079762726602",
"222912440347699456952672385187410476345",
"89443240824658701941654134650757784486",
"200917336753063556064394154914343968861",
"199660758282650071331770797526073427278",
"18461446218705694950575330761922446144",
"130504253762020770866134949158834827427",
"116951732821360904433569676573011343122",
"320560651482858139926002459384862334757",
"336634871906089620453856063755368587325",
"237737241116381897061622474943378970925",
"238558644307469722100981990470187922991",
"282194347163880719134675738326063541153",
"268909080849251881802203947804547484883",
"293701180929285736732970793795505791225",
"106960563037883862102701239744356557398",
"173881989195987164387578777591570634172",
"204992144528374920488269347790362503801",
"165384833752396803597626478729710241977",
"63266720671039816259254891601623638682",
"43978481589627570556701626518995588702",
"203744715813138301927372459193851037575",
"54982870927047490163750567414697108580",
"174752365799525365949692661560328003794",
"215689679865626186267958288693640527637",
"99982988456194551638773611998128176983",
"244402998776358305621050146706991280219",
"209750995026991485519037946427971962396",
"127153429239502956693621758012789667446",
"157431630597062825729137551540128086642",
"55973435962373769099498581755659190556",
"132784417984785056513108293607519094593"
]
},
"signature_type": "Line",
"target": {
"file": "fs/nfsd/nfsctl.c"
},
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@327011a2bb4f7de9c72b891a96ce8d902828bddf",
"id": "CVE-2025-38232-f6ddea37"
}
]