Security readout for executives and security teams
Plain-English summary
A local race in Linux NFSD can crash the kernel when NFS exports are refreshed while the NFSD proc interface is being mounted or its module lifecycle changes. This can disrupt NFS servers and dependent workloads. The supplied evidence demonstrates kernel crashes, but not remote exploitation or successful system compromise.
Executive priority
Prioritize remediation for NFS servers, shared Linux hosts, and systems with automated export or module management. Treat this as an accelerated maintenance issue because a local race can crash the kernel and interrupt services. The supplied evidence does not support emergency internet-exposure response or claims of active exploitation.
Technical view
NFSD exposed its proc exports interface before initialization completed and removed it after teardown began. Concurrent export refresh and NFSD registration could therefore access invalid state, causing NULL dereferences or paging faults in exports_net_open or cache_seq_next_rcu. The referenced fixes publish user-space interfaces last and remove them first.
Likely exposure
Exposure is most likely on Linux systems running or dynamically managing NFSD, particularly where local users or automation can concurrently refresh exports and change NFSD mounts or module state. The source reproduced crashes on ARM64 kernels 5.4 and 6.14; exact affected build boundaries require vendor verification.
Exploitation context
The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction. However, the demonstrated operations may require elevated capabilities depending on configuration. This CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public weaponized exploit.
Researcher notes
The strongest demonstrated impact is kernel OOPS on ARM64 5.4 and 6.14. Although CVSS 7.8 assigns high confidentiality, integrity, and availability impacts, the supplied traces establish crashing rather than data disclosure or code execution. The version data mixes release numbers, commit hashes, and default statuses, so downstream vendor mapping is essential.
Mitigation direction
- Identify Linux systems providing NFS through NFSD or dynamically loading its module.
- Compare running kernel builds with distribution advisories and the referenced stable fixes.
- Install vendor-provided kernel updates incorporating the applicable NFSD race fix.
- Reboot where required so systems run the corrected kernel.
- Until updated, consult vendor guidance for supported risk-reduction measures.
Validation and detection
- Confirm the running kernel package includes the applicable NFSD stable fix.
- Verify systems booted into the updated kernel after maintenance.
- Review kernel logs for OOPS entries involving exports_net_open or cache_seq_next_rcu.
- Validate NFS exports and dependent workloads after updating.
- Do not attempt race reproduction on production systems.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38232 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/49b57b98fa601ae6cc7897bab4515129da8290f7CVE reference, Linux
- https://git.kernel.org/stable/c/88d6785c173a7c4de05bef8c4fd8a9b42ead02d5CVE reference, Linux
- https://git.kernel.org/stable/c/8120e420013d947c890f358f30a2d98ba8ac20bcCVE reference, Linux
- https://git.kernel.org/stable/c/2029ca75cdfa6a25716a5a76b751486cce7e3822CVE reference, Linux
- https://git.kernel.org/stable/c/327011a2bb4f7de9c72b891a96ce8d902828bddfCVE reference, Linux
- https://git.kernel.org/stable/c/f7fb730cac9aafda8b9813b55d04e28a9664d17cCVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.