CVE-2025-38089: Linux Kernel sunrpc DOS Vulnerability

CVE-2025-38089 Overview

CVE-2025-38089 is a null pointer dereference vulnerability in the Linux kernel's sunrpc subsystem. The flaw exists in the server-side Remote Procedure Call (RPC) authentication path. When the RPC decoder returns SVC_GARBAGE without setting the rq_accept_statp pointer, the kernel dereferences a NULL pointer and crashes. The defect was reported by tianshuo han and resolved by treating SVC_GARBAGE as an authentication error rather than as GARBAGE_ARGS, in line with RFC 5531. The issue affects kernel RPC servers, including NFS deployments, and can be triggered by a specially crafted packet from a client.

Critical Impact
A client can send a crafted RPC packet to a Linux kernel RPC server and trigger a NULL pointer dereference, resulting in a kernel crash and denial of service [CWE-476].

Affected Products

Linux Kernel 6.4 (including release candidates rc3 through rc7)
Linux Kernel 6.16 release candidates rc1 and rc2
Linux distributions shipping the sunrpc kernel module without the fix

Discovery Timeline

2025-06-30 - CVE-2025-38089 published to the National Vulnerability Database
2025-07-02 - Vulnerability discussed on the Openwall oss-security mailing list
2025-11-19 - Last updated in NVD database

Technical Details for CVE-2025-38089

Vulnerability Analysis

The vulnerability resides in the server-side sunrpc authentication processing logic. The kernel RPC server invokes svc_authenticate or a program-specific pg_authenticate handler on incoming requests. When these handlers return SVC_GARBAGE, the server treats the result as if it should reply with GARBAGE_ARGS and stores a status value through the rq_accept_statp pointer.

If decoding the RPC reply fails before rq_accept_statp is assigned, that pointer remains either NULL (on a thread's first RPC) or holds a stale reference. Writing through the pointer either crashes the kernel or causes an out-of-bounds memory write, also known as a memory scribble. The defect is classified as a NULL pointer dereference under [CWE-476].

Root Cause

The root cause is an incorrect mapping between RPC decoder failure semantics and reply construction. RFC 5531 specifies that authentication failures must be rejected with an AUTH_ERR status, not accepted with GARBAGE_ARGS. The original code path took the accepted-reply branch and assumed rq_accept_statp had already been populated by the caller. When the decoder bailed out early, that assumption was violated.

Attack Vector

An attacker with the ability to reach a kernel RPC service, for example nfsd or rpc.mountd backed by the kernel sunrpc layer, sends a malformed RPC request whose credential or argument decoding fails in a specific way. The handler returns SVC_GARBAGE without initializing the accept-status pointer. The server then dereferences that pointer, causing the worker thread to crash and taking the kernel down with it.

The CVSS:3.1/AV:L/AC:L/PR:L/UI:N vector indicates local reachability is required in the scoring model, but practical exposure depends on whether the RPC service is reachable across the network from the attacker. A public proof-of-concept named NFSundown is referenced in vendor materials.

No verified code examples are available. See the Linux kernel commit and the Openwall oss-security thread for the patch and discussion. The public proof-of-concept is hosted at NFSundown.

Detection Methods for CVE-2025-38089

Indicators of Compromise

Unexpected kernel oops or panic messages referencing svc_authenticate, svc_process, or sunrpc in dmesg or /var/log/kern.log
Repeated nfsd worker thread crashes correlated with inbound RPC traffic
Malformed RPC AUTH credential payloads observed on port 2049 (NFS) or rpcbind-allocated ports

Detection Strategies

Monitor kernel ring buffer output for NULL pointer dereference stack traces that include sunrpc symbols
Inspect NFS server availability metrics for sudden service restarts that coincide with external RPC traffic
Capture network telemetry on RPC ports and flag clients sending requests with malformed credential structures

Monitoring Recommendations

Forward kernel logs and nfsd health events to a centralized logging or SIEM platform for correlation
Alert on repeated kernel crashes from the same source IP communicating with NFS or other sunrpc-backed services
Track patch state across the Linux fleet to identify hosts still running vulnerable 6.4 or 6.16-rc kernels

How to Mitigate CVE-2025-38089

Immediate Actions Required

Apply the upstream Linux kernel patch that handles SVC_GARBAGE as an AUTH_ERROR with reason AUTH_BADCRED and reboot affected hosts
Restrict network exposure of nfsd and other kernel RPC services to trusted client subnets using host firewalls
Audit which systems run kernel RPC services and prioritize patching internet-facing or multi-tenant servers first

Patch Information

The Linux kernel maintainers committed the fix in the stable trees. Reference the following commits: 353e75b5, 599c489e, 94d10a4d, and c90459cd. Distribution vendors have backported the fix; consume kernel updates through your distribution's package channels.

Workarounds

Block inbound traffic to NFS and rpcbind ports from untrusted networks using iptables, nftables, or upstream network ACLs
Disable nfsd and other kernel RPC services on hosts where they are not required until the kernel can be updated
Where feasible, restrict NFS clients to authenticated peers over Kerberos (sec=krb5) and trusted VPN segments

bash

# Example nftables rule to limit NFS exposure to a trusted subnet
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; }
nft add rule inet filter input ip saddr != 10.0.0.0/24 tcp dport 2049 drop
nft add rule inet filter input ip saddr != 10.0.0.0/24 udp dport 2049 drop