CVE-2025-38338: fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio()
Vulnerability summary
CVE-2025-38338 is a high (CVSS 7.8) Double Free vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 8.1% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 40 · Related 38Timeline
- 10-07-2025PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: fs/nfs/read: fix double-unlock bug in nfs_return_empty_folio() Sometimes, when a file was read while it was being truncated by another NFS client, the kernel could deadlock because folio_unlock() was called twice, and the second call would XOR back the `PG_locked` flag. Most of the time (depending on the timing of the truncation), nobody notices the problem because folio_unlock() gets called three times, which flips `PG_locked` back off: 1. vfs_read, nfs_read_folio, ... nfs_read_add_folio, nfs_return_empty_folio 2. vfs_read, nfs_read_folio, ... netfs_read_collection, netfs_unlock_abandoned_read_pages 3. vfs_read, ... nfs_do_read_folio, nfs_read_add_folio, nfs_return_empty_folio The problem is that nfs_read_add_folio() is not supposed to unlock the folio if fscache is enabled, and a nfs_netfs_folio_unlock() check is missing in nfs_return_empty_folio(). Rarely this leads to a warning in netfs_read_collection(): ------------[ cut here ]------------ R=0000031c: folio 10 is not locked WARNING: CPU: 0 PID: 29 at fs/netfs/read_collect.c:133 netfs_read_collection+0x7c0/0xf00 [...] Workqueue: events_unbound netfs_read_collection_worker RIP: 0010:netfs_read_collection+0x7c0/0xf00 [...] Call Trace: <TASK> netfs_read_collection_worker+0x67/0x80 process_one_work+0x12e/0x2c0 worker_thread+0x295/0x3a0 Most of the time, however, processes just get stuck forever in folio_wait_bit_common(), waiting for `PG_locked` to disappear, which never happens because nobody is really holding the folio lock.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.17% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu120 products
- linux< 6.8.0-100.100
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1046.49
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 000dbe0bec058cbf2ca9e156e4a5584f5158b0f9, < 14f5549ad163be2c018abc1bb38370fff617a243 | ≥ 000dbe0bec058cbf2ca9e156e4a5584f5158b0f9, < 5bf0b9eeb0174686f22c2e5b8fb9f47ad25da6f5 | ≥ 000dbe0bec058cbf2ca9e156e4a5584f5158b0f9, < 1e93b61d3eaa14bfebcc2716ac09d43f3845d420 | ≥ 000dbe0bec058cbf2ca9e156e4a5584f5158b0f9, < 4c10fa44bc5f700e2ea21de2fbae520ba21f19d9 | 6.4
- linux_kernel≥ 6.4, < 6.6.95 | ≥ 6.7, < 6.12.35 | ≥ 6.13, < 6.15.4
Debian1 product
- linux< 6.12.35-1
3 vendors · 123 products
