huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-38206: kernel: Kernel: Double free vulnerability in exFAT filesystem can lead to denial of service
Component: kernel
Severity: Moderate
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-07-04T00:00:00+00:00

A flaw was found in the Linux kernel's exFAT filesystem driver. A local attacker with low privileges could exploit a double free vulnerability within the `delayed_free` function. This memory corruption flaw can lead to a denial of service (DoS), potentially causing system instability or crashes. It may also result in information disclosure.

Statement: This Moderate impact double free vulnerability in the Linux kernel's exFAT filesystem driver affects Red Hat Enterprise Linux 9 and 10. A local attacker with a special group privileges could exploit this flaw, leading to a denial of service, system instability, or crashes.

Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.239, 5.15.186, 6.15.4, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 13d8de1b6568dcc31a95534ced16bc0c9a67bc15
CVE-2025-38220: kernel: ext4: only dirty folios when data journaling regular files
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: only dirty folios when data journaling regular files

fstest generic/388 occasionally reproduces a crash that looks as
follows:

BUG: kernel NULL pointer dereference, address: 0000000000000000
...
Call Trace:
 <TASK>
 ext4_block_zero_page_range+0x30c/0x380 [ext4]
 ext4_truncate+0x436/0x440 [ext4]
 ext4_process_orphan+0x5d/0x110 [ext4]
 ext4_orphan_cleanup+0x124/0x4f0 [ext4]
 ext4_fill_super+0x262d/0x3110 [ext4]
 get_tree_bdev_flags+0x132/0x1d0
 vfs_get_tree+0x26/0xd0
 vfs_cmd_create+0x59/0xe0
 __do_sys_fsconfig+0x4ed/0x6b0
 do_syscall_64+0x82/0x170
 ...

This occurs when processing a symlink inode from the orphan list. The
partial block zeroing code in the truncate path calls
ext4_dirty_journalled_data() -> folio_mark_dirty(). The latter calls
mapping->a_ops->dirty_folio(), but symlink inodes are not assigned an
a_ops vector in ext4, hence the crash.

To avoid this problem, update the ext4_dirty_journalled_data() helper to
only mark the folio dirty on regular files (for which a_ops is
assigned). This also matches the journaling logic in the ext4_symlink()
creation path, where ext4_handle_dirty_metadata() is called directly.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.12.35, 6.15.4, 6.16, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cf6a4c4ac7b6e3214f25df594c9689a62f1bb456
CVE-2025-38248: kernel: Linux kernel:A use-after-free in bridge multicast in br_multicast_port_ctx_init
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-07-09T00:00:00+00:00

A flaw was found in the Linux kernel's bridge multicast functionality. A local user could trigger a use-after-free vulnerability, a type of memory corruption, by improperly configuring network bridge router ports. This issue arises because the system fails to correctly remove ports from its internal router port lists, leading to references to freed memory. Exploiting this flaw could result in system instability, denial of service, or potentially allow for privilege escalation.

Statement: This Moderate impact use-after-free flaw in the Linux kernel's bridge multicast functionality affects Red Hat Enterprise Linux 8 and 9. A local attacker could exploit this vulnerability by improperly configuring network bridge router ports, leading to a kernel information leak, denial of service, or tcp protocol data breach. Red Hat Enterprise Linux 6 and 7 are not affected.

Affected upstream versions: 5.15
Fixed upstream versions: 0, 6.12.67, 6.15.5, 6.16, 6.6.122
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4d3c2a1d4c7c33103f1ddfdbc5cfe1ea4f6d0dcd
CVE-2025-38264: kernel: nvme-tcp: sanitize request list handling
Component: kernel
Severity: Important
CWE: CWE-672 (Operation on a Resource after Expiration or Release)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: sanitize request list handling

Validate the request in nvme_tcp_handle_r2t() to ensure it's not part of
any list, otherwise a malicious R2T PDU might inject a loop in request
list processing.

Statement: The vulnerability lies in the lack of validation for list membership in nvme_tcp_handle_r2t(), potentially allowing malicious R2T PDUs to introduce list corruption or loops. This could lead to denial of service or memory corruption.
The Privileges for the CVSS is Low as the attacker only needs access to an NVMe TCP queue, which may be exposed via user-level networking or containerized environments. This bug can be triggered remotely if a Linux system connects to a malicious or compromised NVMe-over-TCP target. The attacker, by crafting a malformed R2T PDU, could cause list corruption in the initiator’s kernel, potentially leading to memory corruption or denial of service. The issue is not locally triggerable by userspace but can be remotely exploited by an attacker controlling the target. The config option CONFIG_NVME_COMMON disabled in all versions of Red Hat Enterprise Linux, so as result all versions are not affected.

Affected upstream versions: 5.0
Fixed upstream versions: 0, 6.12.36, 6.15.5, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 78a4adcd3fedb0728436e8094848ebf4c6bae006
CVE-2025-38275: kernel: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug

The qmp_usb_iomap() helper function currently returns the raw result of
devm_ioremap() for non-exclusive mappings. Since devm_ioremap() may return
a NULL pointer and the caller only checks error pointers with IS_ERR(),
NULL could bypass the check and lead to an invalid dereference.

Fix the issue by checking if devm_ioremap() returns NULL. When it does,
qmp_usb_iomap() now returns an error pointer via IOMEM_ERR_PTR(-ENOMEM),
ensuring safe and consistent error handling.


Affected upstream versions: 5.15.93 < 5.16, 6.1
Fixed upstream versions: 0, 5.16, 6.1.142, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0b979a409e40457ca1b5cb48755d1f34eee58805
CVE-2025-38288: kernel: scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels
Component: kernel
Severity: Moderate
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels

Correct kernel call trace when calling smp_processor_id() when called in
preemptible kernels by using raw_smp_processor_id().

smp_processor_id() checks to see if preemption is disabled and if not,
issue an error message followed by a call to dump_stack().

Brief example of call trace:
kernel:  check_preemption_disabled: 436 callbacks suppressed
kernel:  BUG: using smp_processor_id() in preemptible [00000000]
         code: kworker/u1025:0/2354
kernel:  caller is pqi_scsi_queue_command+0x183/0x310 [smartpqi]
kernel:  CPU: 129 PID: 2354 Comm: kworker/u1025:0
kernel:  ...
kernel:  Workqueue: writeback wb_workfn (flush-253:0)
kernel:  Call Trace:
kernel:   <TASK>
kernel:   dump_stack_lvl+0x34/0x48
kernel:   check_preemption_disabled+0xdd/0xe0
kernel:   pqi_scsi_queue_command+0x183/0x310 [smartpqi]
kernel:  ...


Affected upstream versions: 6.12
Fixed upstream versions: 0, 6.12.34, 6.15.3, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6589bc3699bcb45b35b3095c44a5af7a4d75ef7e
CVE-2025-38289: kernel: Linux kernel: Denial of service due to use-after-free in scsi: lpfc
Component: kernel
Severity: Moderate
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-10T00:00:00+00:00

A flaw was found in the Linux kernel's scsi: lpfc component. This vulnerability involves a use-after-free error in the dev_loss_tmo_callbk function. During driver unload or fatal error handling, a previously freed object could be accessed. This could allow a local attacker to cause a system crash, leading to a denial of service.


Affected upstream versions: 6.12.5 < 6.12.37, 6.13
Fixed upstream versions: 0, 6.12.37, 6.15.3, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ea405fb4144985d5c60f49c2abd9ba47ea44fdb4
CVE-2025-38292: kernel: wifi: ath12k: fix invalid access to memory
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix invalid access to memory

In ath12k_dp_rx_msdu_coalesce(), rxcb is fetched from skb and boolean
is_continuation is part of rxcb.
Currently, after freeing the skb, the rxcb->is_continuation accessed
again which is wrong since the memory is already freed.
This might lead use-after-free error.

Hence, fix by locally defining bool is_continuation from rxcb,
so that after freeing skb, is_continuation can be used.

Compile tested only.

Statement: This patch addresses a use-after-free vulnerability in the ath12k_dp_rx_msdu_coalesce() function, where memory was accessed after freeing the associated skb. Specifically, the rxcb->is_continuation field was read post-free, leading to potential kernel crashes. The patch stores the value before freeing the buffer. The Required Privileges for CVSS is Low (PR:L), because triggering this flaw likely requires the ability to inject or manipulate network traffic handled by the Wi-Fi driver, which is feasible from a local user space process using standard socket interfaces or crafted packets.

Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.12.34, 6.15.3, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 371b340affa52f280f6eadfd25fbd43f09f0d5c0
CVE-2025-38322: kernel: perf/x86/intel: Fix crash in icl_update_topdown_event()
Component: kernel
Severity: Moderate
CWE: CWE-822 (Untrusted Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel: Fix crash in icl_update_topdown_event()

The perf_fuzzer found a hard-lockup crash on a RaptorLake machine:

  Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000
  CPU: 23 UID: 0 PID: 0 Comm: swapper/23
  Tainted: [W]=WARN
  Hardware name: Dell Inc. Precision 9660/0VJ762
  RIP: 0010:native_read_pmc+0x7/0x40
  Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ...
  RSP: 000:fffb03100273de8 EFLAGS: 00010046
  ....
  Call Trace:
    <TASK>
    icl_update_topdown_event+0x165/0x190
    ? ktime_get+0x38/0xd0
    intel_pmu_read_event+0xf9/0x210
    __perf_event_read+0xf9/0x210

CPUs 16-23 are E-core CPUs that don't support the perf metrics feature.
The icl_update_topdown_event() should not be invoked on these CPUs.

It's a regression of commit:

  f9bdf1f95339 ("perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read")

The bug introduced by that commit is that the is_topdown_event() function
is mistakenly used to replace the is_topdown_count() call to check if the
topdown functions for the perf metrics feature should be invoked.

Fix it.


Affected upstream versions: 6.1.134 < 6.1.149, 6.6.87 < 6.6.101, 6.12.23 < 6.12.49, 6.13.11 < 6.14, 6.14.2 < 6.15, 6.15
Fixed upstream versions: 0, 6.1.149, 6.12.49, 6.14, 6.15, 6.15.4, 6.16, 6.6.101
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 702ea6028032d6c1fe96c2d4762a3575e3654819
CVE-2025-38329: kernel: firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)

KASAN reported out of bounds access - cs_dsp_mock_wmfw_add_info(),
because the source string length was rounded up to the allocation size.


Affected upstream versions: 6.14
Fixed upstream versions: 0, 6.15.4, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0000a2303ba78b6424ff15b5085b5f5098750a2e
CVE-2025-38330: kernel: firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)

KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets().
The code uses mock_coeff_template.length_bytes (4 bytes) for register value
allocations. But later, this length is set to 8 bytes which causes
test code failures.

As fix, just remove the lenght override, keeping the original value 4
for all operations.


Affected upstream versions: 6.14
Fixed upstream versions: 0, 6.15.4, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e3dafc64b90546eb769f33333afabd9e3e915757
CVE-2025-38332: kernel: scsi: lpfc: Use memcpy() for BIOS version
Component: kernel
Severity: Moderate
CWE: CWE-170 (Improper Null Termination)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Use memcpy() for BIOS version

The strlcat() with FORTIFY support is triggering a panic because it
thinks the target buffer will overflow although the correct target
buffer size is passed in.

Anyway, instead of memset() with 0 followed by a strlcat(), just use
memcpy() and ensure that the resulting buffer is NULL terminated.

BIOSVersion is only used for the lpfc_printf_log() which expects a
properly terminated string.


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.239, 5.15.186, 5.4.295, 6.1.142, 6.12.35, 6.15.4, 6.16, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ac7bfaa099ec3e4d7dfd0ab9726fc3bc7911365d
CVE-2025-38349: kernel: Linux kernel use-after-free in eventpoll
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-18T00:00:00+00:00

A flaw was found in the Linux kernel's eventpoll (epoll) mechanism. A local attacker could exploit a use-after-free vulnerability due to incorrect handling of the 'ep' refcount while the 'ep' mutex is still held. This can lead to memory corruption, potentially allowing the attacker to achieve privilege escalation or execute arbitrary code on the system.


Affected upstream versions: 6.1.175 < 6.1.178, 5.15.209 < 5.16, 6.4
Fixed upstream versions: 0, 5.16, 6.1.178, 6.12.39, 6.15.7, 6.16, 6.6.99
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b0821ec902d39062356cb644c16e17a705d1c9f5
CVE-2025-38350: kernel: net/sched: Always pass notifications when child class becomes empty
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-19T00:00:00+00:00

A use-after-free (UAF) vulnerability was found in the Linux kernel's net/sched subsystem, specifically in the Credit-Based Shaper (CBS) qdisc implementation (sch_cbs). The vulnerability occurs because the CBS qdisc's reset function (qdisc_reset_queue()) only resets its internal queue but fails to reset its child qdisc recursively. As a result, a mismatch in queue length (qlen) occurs between CBS and its children during interface resets, eventually allowing attackers to trigger UAF on a parent HFSC scheduler.

Statement: On Red Hat Enterprise Linux 8 and later releases, regular (non-root) users can exploit this issue by abusing unprivileged user namespaces. On Red Hat Enterprise Linux 7, unprivileged user namespaces are disabled by default. Red Hat Enterprise Linux 6 did not include support for them at all, meaning that root privileges are necessary to trigger this flaw.

Affected upstream versions: 5.4.294 < 5.4.296, 5.10.238 < 5.10.240, 5.15.185 < 5.15.187, 6.1.141 < 6.1.144, 6.6.93 < 6.6.97, 6.12.31 < 6.12.37, 6.14.9 < 6.15, 6.15
Fixed upstream versions: 0, 5.10.240, 5.15.187, 5.4.296, 6.1.144, 6.12.37, 6.15, 6.15.6, 6.16, 6.6.97
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3b290923ad2b23596208c1e29520badef4356a43
CVE-2025-38352: kernel: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
Component: kernel
Severity: Important
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-22T00:00:00+00:00

A race condition was found in the Linux kernel’s POSIX CPU timer handling, where handle_posix_cpu_timers() may run concurrently with posix_cpu_timer_del() on an exiting task which could result in use-after-free scenarios. An attacker with  local user access could use this flaw to crash or escalate their privileges on a system.

Statement: This CVE is rated with Important severity because it may allow an attacker with local user access to escalate their privileges on a target system.

Affected upstream versions: 2.6.36
Fixed upstream versions: 0, 5.10.239, 5.15.186, 5.4.295, 6.1.142, 6.12.34, 6.15.3, 6.16, 6.6.94
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 78a4b8e3795b31dae58762bc091bb0f4f74a2200
CVE-2025-38369: kernel: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using

Running IDXD workloads in a container with the /dev directory mounted can
trigger a call trace or even a kernel panic when the parent process of the
container is terminated.

This issue occurs because, under certain configurations, Docker does not
properly propagate the mount replica back to the original mount point.

In this case, when the user driver detaches, the WQ is destroyed but it
still calls destroy_workqueue() attempting to completes all pending work.
It's necessary to check wq->wq and skip the drain if it no longer exists.

Statement: This vulnerability in the Intel IDXD DMA engine driver results from a missing check before draining a potentially destroyed workqueue object. When running workloads in containers with /dev mounted, the driver may attempt to call `drain_workqueue()` on a NULL pointer after the parent process exits, leading to a kernel panic.

Affected upstream versions: 5.6
Fixed upstream versions: 0, 6.12.36, 6.15.5, 6.16, 6.6.96
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e0051a3daa8b2cb318b03b2f9317c3e40855847a
CVE-2025-38383: kernel: Linux kernel: Denial of Service due to data race in vmalloc's show_numa_info function
Component: kernel
Severity: Moderate
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-25T00:00:00+00:00

A flaw was found in the Linux kernel. A data race vulnerability exists in the `show_numa_info()` function within the `mm/vmalloc` component. This occurs because the `m->private` memory is accessible to multiple central processing units (CPUs) simultaneously, leading to inconsistent data reads and writes. A local attacker could exploit this to cause a system crash or other unpredictable behavior, resulting in a Denial of Service (DoS).


Affected upstream versions: 6.9
Fixed upstream versions: 0, 6.12.37, 6.15.6, 6.16
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ead91de35d9cd5c4f80ec51e6020f342079170af
CVE-2025-38393: kernel: NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
Component: kernel
Severity: Moderate
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN

We found a few different systems hung up in writeback waiting on the same
page lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in
pnfs_update_layout(), however the pnfs_layout_hdr's plh_outstanding count
was zero.

It seems most likely that this is another race between the waiter and waker
similar to commit ed0172af5d6f ("SUNRPC: Fix a race to wake a sync task").
Fix it up by applying the advised barrier.


Affected upstream versions: 5.10.124 < 5.10.240, 5.15.49 < 5.15.187, 5.18.6 < 5.19, 5.19
Fixed upstream versions: 0, 5.10.240, 5.15.187, 5.19, 6.1.144, 6.12.37, 6.15.6, 6.16, 6.6.97
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 08287df60bac5b008b6bcdb03053988335d3d282