How the Vulnerability Works
This vulnerability occurs in the Linux kernel’s netfs subsystem when handling cache operations. The issue arises when filesystems like NFS or Ceph (which don’t implement invalidate_cache) encounter write failures to cache (NETFS_WRITE_TO_CACHE). The kernel attempts to call the non-existent `invalidate_cache` method, leading to a NULL pointer dereference. This triggers a kernel panic with supervisor instruction fetch error, crashing the system. The vulnerability manifests in the `netfs_write_collection_worker` function when processing cached writes, where missing NULL check before calling `invalidate_cache` causes uncontrolled system crash.
DailyCVE Form:
Platform: Linux Kernel
Version: Up to 6.13.3
Vulnerability: NULL Pointer Dereference
Severity: Critical
Date: 04/10/2025
What Undercode Say:
Exploitation Analysis:
1. Crash system via malformed cache operations
2. Trigger through filesystem operations on NFS/Ceph
3. Exploit requires write access to affected filesystems
Protection Commands:
Check kernel version uname -r Patch verification grep 'netfs_write_collection_worker' /proc/kallsyms Temporary mitigation echo 0 > /proc/sys/net/netfs/cache_enabled
Vulnerable Code Pattern:
if (test_bit(NETFS_WRITE_TO_CACHE, &subreq->flags) &&
!test_bit(NETFS_SREQ_WRITE_TO_CACHE, &subreq->flags)) {
netfs_invalidate_cache(subreq); // Missing NULL check
}
Patched Code Example:
if (subreq->netfs_ops->invalidate_cache &&
test_bit(NETFS_WRITE_TO_CACHE, &subreq->flags) &&
!test_bit(NETFS_SREQ_WRITE_TO_CACHE, &subreq->flags)) {
subreq->netfs_ops->invalidate_cache(subreq);
}
Detection Script:
import os
def check_vulnerable():
kernel_ver = os.uname().release.split('.')
major, minor = int(kernel_ver[bash]), int(kernel_ver[bash])
return (major == 6 and minor <= 13) or (major < 6)
Mitigation Steps:
1. Update to patched kernel version
2. Disable affected filesystems if unused
3. Implement kernel module signing
4. Restrict filesystem mounting privileges
Debugging Commands:
Check for crash logs dmesg | grep 'netfs_write_collection_worker' Monitor filesystem operations strace -f -e trace=file -p <pid> Kernel debugging crash /usr/lib/debug/boot/vmlinux-$(uname -r) /var/crash/dumpfile
References:
Reported By: https://nvd.nist.gov/vuln/detail/CVE-2025-22002
Extra Source Hub:
Undercode
