CVE-2025-38393 NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
A race condition in the Linux kernel's NFSv4/pNFS implementation can cause system hangs during writeback operations, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38393?
CVE-2025-38393 is a high-severity vulnerability in Debian Debian Linux, published on 25 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
We found a few different systems hung up in writeback waiting on the same page lock, and one task waiting on the NFS_LAYOUT_DRAIN bit in pnfs_update_layout(), however the pnfs_layout_hdr's plh_outstanding count was zero.
It seems most likely that this is another race between the waiter and waker similar to commit ed0172af5d6f ("SUNRPC: Fix a race to wake a sync task"). Fix it up by applying the advised barrier.
Weakness: CWE-362
Which versions are affected by CVE-2025-38393?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38393?
Apply the vendor's patch.
Is CVE-2025-38393 being exploited?
There is no known exploitation of CVE-2025-38393 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-65717, AZL-73010, BELL-CVE-2025-38393, DEBIAN-CVE-2025-38393, GHSA-93f5-rwwh-v8p5, ROOT-OS-DEBIAN-11-CVE-2025-38393 and 4 more.