Skip to main content

Linux Kernel CVE-2025-68349

HIGH
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Reachable remotely via a misbehaving pNFS server but only under a specific layout-invalidation/writeback race (AC:H); impact is a kernel crash, so availability-only with no C/I.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 30, 2026 - 06:42 vuln.today
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.5 (HIGH)
CVE Published
Dec 24, 2025 - 11:15 cve.org
HIGH 7.5
CVE Published
Dec 24, 2025 - 11:15 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

Fixes a crash when layout is null during this call stack:

write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode

pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout.

AnalysisAI

Denial of service in the Linux kernel's NFSv4/pNFS client allows a null-pointer dereference and system crash during inode writeback, affecting hosts mounting parallel-NFS (pNFS) exports. The flaw occurs because NFS_INO_LAYOUTCOMMIT was not cleared in pnfs_mark_layout_stateid_invalid, so the write_inode → nfs4_write_inode → pnfs_layoutcommit_inode path may dereference a layout that has already been freed. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%) indicates minimal observed exploitation interest despite the CVSS 7.5 rating.

Technical ContextAI

The affected subsystem is the Linux kernel NFSv4 client with pNFS (parallel NFS) layout support, which lets clients perform I/O directly against storage devices while committing layout state back to the metadata server. pnfs_set_layoutcommit relies on the layout segment (lseg) refcount to keep the layout structure alive; when a layout stateid is invalidated via pnfs_mark_layout_stateid_invalid, the NFS_INO_LAYOUTCOMMIT flag was left set, so a subsequent layoutcommit on inode writeback could reference a layout pointer that is null/freed. The root cause is a classic null-pointer dereference / use-after-invalidation state-management bug (CWE-476-class, though CWE is marked N/A in the input); impact is limited to availability (kernel oops/crash), with no confidentiality or integrity effect per the CVSS vector.

Affected ProductsAI

The Linux kernel NFSv4/pNFS client is affected; exact version boundaries are not enumerated in the input, but the fix was backported across multiple stable branches as evidenced by eight separate git.kernel.org stable commit references (e.g. 084bebe82ad86f718a3af84f34761863e63164ed and 38694f9aae00459ab443a7dc8b3949a6b33b560a). No CPE strings were provided in the input to pin precise version ranges. Siemens has issued a downstream advisory (SSA-019113, cert-portal.siemens.com/productcert/html/ssa-019113.html) indicating certain Siemens products embedding the affected kernel may also be impacted.

RemediationAI

Upstream fix available (commit/stable backports); a released patched version is not independently confirmed from the input, so update to the latest kernel from your distribution or stable series that includes the change clearing NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid - the relevant commits are published at git.kernel.org/stable (including 084bebe82ad86f718a3af84f34761863e63164ed and 59947dff0fb7c19c09ce6dccbcd253fd542b6c25). Siemens-managed environments should follow advisory SSA-019113 (cert-portal.siemens.com/productcert/html/ssa-019113.html) for product-specific fixed builds. If immediate patching is not possible, the most effective compensating control is to avoid pNFS: mount NFSv4 exports without pNFS layout usage (e.g., use a server/export configuration that does not grant pNFS layouts, or disable pNFS layout drivers), which removes the vulnerable code path at the cost of losing pNFS direct-I/O performance benefits; restricting which NFS servers clients may mount also reduces exposure to a misbehaving server inducing the layout state.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2025-68349 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy