Strix
26.1K

CVE-2025-68185

UnknownEPSS 0.18%

Last modified

CVE-2025-68185 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Theoretically it's an oopsable race, but I don't believe one can manage to hit it on real hardware; might become doable on a KVM, but it still won't be easy to attack. Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of put_unaligned_be64(), we can put that under ->d_lock and be done with that.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Theoretically it's an oopsable race, but I don't believe one can manage to hit it on real hardware; might become doable on a KVM, but it still won't be easy to attack. Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of put_unaligned_be64(), we can put that under ->d_lock and be done with that.

Metrics

EPSS Probability
0.18%

7.4th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 6025f641a0e30afdc5aa62017397b1860ad9f677; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e6cafe71eb3b5579b245ba1bd528a181e77f3df1; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < fa4daf7d11e45b72aad5d943a7ab991f869fff79; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 504b3fb9948a9e96ebbabdee0d33966a8bab15cb; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < eacfd08b26a062f1095b18719715bc82ad35312e; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 40be5b9080114f18b0cea386db415b68a7273c1a; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f5e570eaab36a110c6ffda32b87c51170990c2d1; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a890a2e339b929dbd843328f9a92a1625404fe63
LinuxLinux2.6.12

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2025-68185?
In the Linux kernel, the following vulnerability has been resolved: nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Theoretically it's an oopsable race, but I don't believe one can manage to hit it on real hardware; might become doable on a KVM, but it still won't be easy to attack. Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of put_unaligned_be64(), we can put that under ->d_lock and be done with that.
How severe is CVE-2025-68185?
Severity scoring for CVE-2025-68185 is pending analysis. The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2025-68185?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-68185?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST