HighFix available
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.248, 5.15.198, 6.1.160, 6.12.63, 6.17.13, 6.18.2, 6.6.120
- CVEs
- CVE-2025-68349
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 19:15 UTC · Revision 1
Source evidence
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
core-osv · Original sourcePublished 24 Dec 2025, 10:32 UTC
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout.
osv:CVE-2025-68349
Kernel
Fixed versions: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.63, 6.17.13, 6.18.2
Complete source record
{
"id": "30c1afb2300b6a7c67033657cd72e6b466916f40e7da8508bf090926614c528d",
"url": "https://osv.dev/vulnerability/CVE-2025-68349",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid",
"summary": "In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode pnfs_set_layoutcommit relies on the lseg refcount to keep the layout around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt to reference a null layout.",
"evidence": "osv:CVE-2025-68349",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.248",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.198",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.160",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.120",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.63",
"evidence": "/affected/1/ranges"
},
{
"value": "6.17.13",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2025-68349",
"aliases": [
"CVE-2025-68349"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "fe1cf9469d7bcb6af27e42eb555a41b0135bce4a"
},
{
"fixed": "084bebe82ad86f718a3af84f34761863e63164ed"
},
{
"fixed": "b6e4e3a08c03200cc4b8067ec8ab3172a989d6fc"
},
{
"fixed": "104080582ae0aa6dce6c6d75ff89062efe84673b"
},
{
"fixed": "f718f9ea6094843b8c059b073af49ad61e9f49bb"
},
{
"fixed": "59947dff0fb7c19c09ce6dccbcd253fd542b6c25"
},
{
"fixed": "ca2e7fdad7c683b64821c94a58b9b68733214dad"
},
{
"fixed": "38694f9aae00459ab443a7dc8b3949a6b33b560a"
},
{
"fixed": "e0f8058f2cb56de0b7572f51cd563ca5debce746"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68349.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.10.0"
},
{
"fixed": "5.10.248"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.198"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.160"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.120"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.63"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.17.13"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.18.0"
},
{
"fixed": "6.18.2"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68349.json"
}
}
],
"modified": "2026-10-28T02:30:31.489743305Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
"https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
"https://git.kernel.org/stable/c/084bebe82ad86f718a3af84f34761863e63164ed",
"https://git.kernel.org/stable/c/104080582ae0aa6dce6c6d75ff89062efe84673b",
"https://git.kernel.org/stable/c/38694f9aae00459ab443a7dc8b3949a6b33b560a",
"https://git.kernel.org/stable/c/59947dff0fb7c19c09ce6dccbcd253fd542b6c25",
"https://git.kernel.org/stable/c/b6e4e3a08c03200cc4b8067ec8ab3172a989d6fc",
"https://git.kernel.org/stable/c/ca2e7fdad7c683b64821c94a58b9b68733214dad",
"https://git.kernel.org/stable/c/e0f8058f2cb56de0b7572f51cd563ca5debce746",
"https://git.kernel.org/stable/c/f718f9ea6094843b8c059b073af49ad61e9f49bb",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68349.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-68349",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68349.json"
}
},
"related_cves": [
{
"value": "CVE-2025-68349",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 498655,
"published_at": "2025-12-24T10:32:41.253+00:00"
}