{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"deaeb74ae9318252829c59a84a7d2316fc335660","status":"affected","version":"a4bc287943f5695209ff36bdc89f17b48d68fae7","versionType":"git"},{"lessThan":"0fccf5f01ed28725cc313a66ca1247eef911d55e","status":"affected","version":"f4e44b393389c77958f7c58bf4415032b4cda15b","versionType":"git"},{"lessThan":"a97668ec6d73dab237cd1c15efe012a10090a4ed","status":"affected","version":"f4e44b393389c77958f7c58bf4415032b4cda15b","versionType":"git"},{"lessThan":"5060e1a5fef184bd11d298e3f0ee920d96a23236","status":"affected","version":"f4e44b393389c77958f7c58bf4415032b4cda15b","versionType":"git"},{"lessThan":"d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0","status":"affected","version":"f4e44b393389c77958f7c58bf4415032b4cda15b","versionType":"git"},{"lessThan":"83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64","status":"affected","version":"f4e44b393389c77958f7c58bf4415032b4cda15b","versionType":"git"},{"lessThan":"b31da62889e6d610114d81dc7a6edbcaa503fcf8","status":"affected","version":"f4e44b393389c77958f7c58bf4415032b4cda15b","versionType":"git"},{"lessThan":"5.10.239","status":"affected","version":"5.10.220","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.239","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.186","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.142","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.95","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.35","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.16","versionType":"original_commit_for_fix"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]}],"cveId":"CVE-2025-38231","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: Initialize ssc before laundromat_work to prevent NULL dereference\n\nIn nfs4_state_start_net(), laundromat_work may access nfsd_ssc through\nnfs4_laundromat -> nfsd4_ssc_expire_umount. If nfsd_ssc isn't initialized,\nthis can cause NULL pointer dereference.\n\nNormally the delayed start of laundromat_work allows sufficient time for\nnfsd_ssc initialization to complete. However, when the kernel waits too\nlong for userspace responses (e.g. in nfs4_state_start_net ->\nnfsd4_end_grace -> nfsd4_record_grace_done -> nfsd4_cld_grace_done ->\ncld_pipe_upcall -> __cld_pipe_upcall -> wait_for_completion path), the\ndelayed work may start before nfsd_ssc initialization finishes.\n\nFix this by moving nfsd_ssc initialization before starting laundromat_work.","epss":{"date":"2026-11-05","percentile":0.081,"score":0.00184},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793911941659,"publishedAt":1751636264978,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/deaeb74ae9318252829c59a84a7d2316fc335660"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/0fccf5f01ed28725cc313a66ca1247eef911d55e"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/a97668ec6d73dab237cd1c15efe012a10090a4ed"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/5060e1a5fef184bd11d298e3f0ee920d96a23236"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/d622c2ee6c08147ab8c9b9e37d93b6e95d3258e0"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/83ac1ba8ca102ab5c0ed4351f8ac6e74ac4d5d64"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b31da62889e6d610114d81dc7a6edbcaa503fcf8"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"},{"source":"ADP: CVE","tags":[],"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}],"remediation":[],"revision":"67714b80347ddc35d8fcf459f64ccfaed0fb456c3a6f02ff8de7e5cea8ac65b3","sources":[{"modifiedAt":1793911941659,"name":"CNA: Linux","retrievedAt":1793913623534,"url":"https://www.cve.org/CVERecord?id=CVE-2025-38231"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913634545,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-38231"}],"ssvc":{"assessedAt":1793911919242,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"nfsd: Initialize ssc before laundromat_work to prevent NULL dereference","updatedAt":1793913634545}