Not yet scoredPublished Jul 4, 2025

CVE-2025-38231nfsd: Initialize ssc before laundromat_work to prevent NULL dereference

Updated under an hour ago (Oct 26, 2026, 8:00 PM ET)

Does this affect you?

It affects Linux and 3 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference In nfs4_state_start_net(), laundromat_work may access nfsd_ssc through nfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized, this can cause NULL pointer dereference. Normally the delayed start of laundromat_work allows sufficient time for nfsd_ssc initialization to complete. However, when the kernel waits too long for userspace responses (e.g. in nfs4_state_start_net -> nfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done -> cld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the delayed work may start before nfsd_ssc initialization finishes. Fix this by moving nfsd_ssc initialization before starting laundromat_work.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Not yet received
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a4bc287943f5695209ff36bdc89f17b48d68fae7 before deaeb74ae9318252829c59a84a7d2316fc335660; from f4e44b393389c77958f7c58bf4415032b4cda15b before 0fccf5f01ed28725cc313a66ca1247eef911d55e; from f4e44b393389c77958f7c58bf4415032b4cda15b before a97668ec6d73dab237cd1c15efe012a10090a4ed; from f4e44b393389c77958f7c58bf4415032b4cda15b before 5060e1a5fef184bd11d298e3f0ee920d96a23236; from f4e44b393389c77958f7c58bf4415032b4cda15b before d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0; from f4e44b393389c77958f7c58bf4415032b4cda15b before 83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64; from f4e44b393389c77958f7c58bf4415032b4cda15b before b31da62889e6d610114d81dc7a6edbcaa503fcf8; from 5.10.220 before 5.10.239	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP

References

References

https://git.kernel.org/stable/c/deaeb74ae9318252829c59a84a7d2316fc335660
https://git.kernel.org/stable/c/0fccf5f01ed28725cc313a66ca1247eef911d55e
https://git.kernel.org/stable/c/a97668ec6d73dab237cd1c15efe012a10090a4ed
https://git.kernel.org/stable/c/5060e1a5fef184bd11d298e3f0ee920d96a23236
https://git.kernel.org/stable/c/d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0
https://git.kernel.org/stable/c/83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64
https://git.kernel.org/stable/c/b31da62889e6d610114d81dc7a6edbcaa503fcf8

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.