Race Condition in Linux Kernel Netfs Component Affects Various Applications

CVE-2025-38492

What is CVE-2025-38492?

A race condition vulnerability exists within the netfs component of the Linux kernel, where the setting of the ALL_QUEUED flag can occur after the last subrequest terminates during asynchronous write operations. This situation may prevent the collection of final notifications, resulting in a request hanging indefinitely. The vulnerability primarily affects applications utilizing netfslib, such as Ceph, during the copying of data to cache. A fix has been implemented to queue the collector after setting ALL_QUEUED, ensuring that requests are appropriately concluded even in the presence of asynchronous operations. Additionally, enhancements have been made to trace and monitor these processes effectively.

References