CVE-2025-38028: Linux Kernel

Medium severity, CVSS 4.7. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: Fix a race in nfs_local_open_fh() Once the clp->cl_uuid.lock has been dropped, another CPU could come in and free the struct nfsd_file that was just added. To prevent that from happening, take the RCU read lock before dropping the spin lock.

Affected products

• Linux Linux Kernel: from 6.14, before 6.14.8 (fixed in 6.14.8); version 6.15 only

Published 2025-06-18. Last modified 2026-07-30.