Linux Kernel NFS Vulnerability Affecting File Access

CVE-2025-38338

What is CVE-2025-38338?

A vulnerability has been identified in the Linux kernel affecting the Network File System (NFS) where a double-unlock bug in the function nfs_return_empty_folio() can lead to deadlocks during file reads. When a file is accessed while being truncated by another NFS client, the kernel may call folio_unlock() twice mistakenly. This oversight can result in processes being indefinitely stuck as they wait for the PG_locked state to be released. Although the issue is not frequently noticeable, it creates warnings under specific conditions, signifying potential stability risks in systems utilizing NFS.

References