Security readout for executives and security teams
Plain-English summary
A race condition in the Linux kernel’s NFS local-I/O handling may allow a low-privileged local user to compromise confidentiality, integrity, or system availability. The issue requires local access and does not require user interaction. Systems using affected kernels and the relevant NFS/localio path deserve prompt review.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially on shared or multi-user Linux systems. It is not documented as remotely exploitable or actively exploited, so emergency internet-wide response is unsupported. Establish affected inventory promptly and deploy vendor-supported corrected kernels through normal expedited patching procedures.
Technical view
In nfs_local_open_fh(), the UUID spin lock could be released before RCU protection was acquired. Another CPU could then free the newly added nfsd_file, creating unsafe access to freed kernel memory. The documented correction acquires the RCU read lock before dropping the spin lock.
Likely exposure
Exposure is limited to affected Linux kernel versions where the NFS/localio code path is present and exercised. The bundle identifies the Linux 6.14–6.15 range but does not provide sufficiently clear fixed-version boundaries for every branch or distribution package. Confirm status with kernel and distribution advisories.
Exploitation context
The CVSS 3.1 score is 7.8, reflecting local, low-complexity exploitation requiring low privileges, with potentially high confidentiality, integrity, and availability impact. The bundle states KEV is false and provides no evidence of active exploitation or a public exploit. Practical prerequisites beyond reaching the affected local NFS path are not documented.
Researcher notes
The core issue is a concurrency lifetime race involving clp->cl_uuid.lock, RCU protection, and struct nfsd_file. The source bundle supplies two stable-kernel commits but no CWE, crash signature, exploit analysis, or definitive per-branch version mapping. Avoid assuming exploitability beyond the supplied local CVSS characteristics.
Mitigation direction
- Apply a vendor-supported kernel containing the referenced upstream or stable correction.
- Check distribution security advisories for exact fixed package versions.
- Prioritize multi-user systems where untrusted users have local access.
- Restrict unnecessary local access while patch status is being established.
Validation and detection
- Record each system’s running kernel and distribution package version.
- Compare package versions with current distribution or kernel vendor advisories.
- Determine whether affected systems use the NFS/localio functionality.
- Confirm the installed kernel incorporates one of the referenced fixes.
- Reboot after updating and verify the corrected kernel is running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38028 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/185a2f2ddabdcf999823f61de67f86376883920dCVE reference, Linux
- https://git.kernel.org/stable/c/fa7ab64f1e2fdc8f2603aab8e0dd20de89cb10d9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.