CVE-2025-38724
In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.38% probability · 31th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- linux/linux kernel · debian/debian linux
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1Patch
- https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3Patch
- https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8dPatch
- https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1Patch
- https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306Patch
- https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68Patch
- https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8bPatch
- https://git.kernel.org/stable/c/d71abd1ae4e0413707cd42b10c24a11d1aa71772Patch
- https://git.kernel.org/stable/c/f3aac6cf390d8b80e1d82975faf4ac61175519c0Patch
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlMailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.