CVE-2025-38724 (GCVE-0-2025-38724)
Vulnerability from cvelistv5
Published
2025-09-04 15:33
Modified
2026-08-05 12:04
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().
References
Impacted products
Vendor Product Version
Linux Linux Version: d20c11d86d8f821a64eac7d6c8f296f06d935f4f
Version: d20c11d86d8f821a64eac7d6c8f296f06d935f4f
Version: d20c11d86d8f821a64eac7d6c8f296f06d935f4f
Version: d20c11d86d8f821a64eac7d6c8f296f06d935f4f
Version: d20c11d86d8f821a64eac7d6c8f296f06d935f4f
Version: d20c11d86d8f821a64eac7d6c8f296f06d935f4f
Version: d20c11d86d8f821a64eac7d6c8f296f06d935f4f
Version: d20c11d86d8f821a64eac7d6c8f296f06d935f4f
Version: d20c11d86d8f821a64eac7d6c8f296f06d935f4f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:41:53.468Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:28.849Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38724",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:40:31.454640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:02.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3f252a73e81aa01660cb426735eab932e6182e8d",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "d35ac850410966010e92f401f4e21868a9ea4d8b",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "f3aac6cf390d8b80e1d82975faf4ac61175519c0",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "22f45cedf281e6171817c8a3432c44d788c550e1",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "d71abd1ae4e0413707cd42b10c24a11d1aa71772",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "74ad36ed60df561a303a19ecef400c7096b20306",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "36e83eda90e0e4ac52f259f775b40b2841f8a0a3",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            },
            {
              "lessThan": "908e4ead7f757504d8b345452730636e298cbf68",
              "status": "affected",
              "version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.43",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.11",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()\n\nLei Lu recently reported that nfsd4_setclientid_confirm() did not check\nthe return value from get_client_locked(). a SETCLIENTID_CONFIRM could\nrace with a confirmed client expiring and fail to get a reference. That\ncould later lead to a UAF.\n\nFix this by getting a reference early in the case where there is an\nextant confirmed client. If that fails then treat it as if there were no\nconfirmed client found at all.\n\nIn the case where the unconfirmed client is expiring, just fail and\nreturn the result from get_client_locked()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the nfsd in-kernel NFSv4 server\u0027s SETCLIENTID_CONFIRM handler, reached directly from an NFSv4.0 COMPOUND sent over TCP/2049 by a remote peer. No local access to the server is needed.\nAC:L - The attacker controls its own side of the race and can issue unauthenticated SETCLIENTID_CONFIRM operations at arbitrary rate, and the vulnerable window (force_expire_client() parked in wait_event for cl_rpc_users to drain) stays open as long as the attacker keeps RPCs in flight, so the window is attacker-widened rather than narrow. The forced-expire trigger is an administrative action, but it is the documented response to exactly the kind of misbehaving client the attacker can pose as.\nPR:N - OP_SETCLIENTID_CONFIRM is ALLOWED_WITHOUT_FH/ALLOWED_ON_ABSENT_FS, so no filehandle or export access check is performed, and under the default AUTH_SYS/AUTH_NULL flavors the RPC credentials are self-asserted and never verified. Any host able to reach the NFS port can reach the bug.\nUI:N - The attack is completed entirely by the attacker\u0027s own NFS traffic; no victim opens a file, mounts a filesystem, or otherwise interacts. The concurrent client-expiry is a system/administrative state condition folded into Attack Complexity, not user interaction.\nS:U - The corrupted object (struct nfs4_client) and all consequences remain within the kernel of the NFS server; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed struct nfs4_client is used after free (fsnotify_dentry, nfsd4_probe_callback) and its slab can be re-occupied by attacker-groomed data, giving a path to disclose arbitrary kernel memory. Per kernel scoring guidance a UAF is scored C:H.\nI:H - The UAF yields concrete write primitives on freed memory \u2014 set_bit() on cl_flags, memcpy() into cl_cb_conn, and an unbalanced atomic_dec() in put_client_renew_locked() \u2014 plus a function-pointer dereference via nfsd4_run_cb(\u0026clp-\u003ecl_cb_null), which is exploitable for control-flow hijacking.\nA:H - The use-after-free reliably oopses or panics the NFS server; additionally renew_client_locked() hits WARN_ON(1) (fatal with panic_on_warn) and the cl_rpc_users underflow to -1 leaves force_expire_client() stuck forever in wait_event, producing an unkillable hung task."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:18.336Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3aac6cf390d8b80e1d82975faf4ac61175519c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d71abd1ae4e0413707cd42b10c24a11d1aa71772"
        },
        {
          "url": "https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306"
        },
        {
          "url": "https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68"
        }
      ],
      "title": "nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38724",
    "datePublished": "2025-09-04T15:33:22.370Z",
    "dateReserved": "2025-04-16T04:51:24.033Z",
    "dateUpdated": "2026-08-05T12:04:18.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T17:41:53.468Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC CN 4100\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V5.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.5\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-032379.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-07-14T12:42:28.849Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-38724\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:40:31.454640Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:37:23.912Z\"}}], \"cna\": {\"title\": \"nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable code is the nfsd in-kernel NFSv4 server\u0027s SETCLIENTID_CONFIRM handler, reached directly from an NFSv4.0 COMPOUND sent over TCP/2049 by a remote peer. No local access to the server is needed.\\nAC:L - The attacker controls its own side of the race and can issue unauthenticated SETCLIENTID_CONFIRM operations at arbitrary rate, and the vulnerable window (force_expire_client() parked in wait_event for cl_rpc_users to drain) stays open as long as the attacker keeps RPCs in flight, so the window is attacker-widened rather than narrow. The forced-expire trigger is an administrative action, but it is the documented response to exactly the kind of misbehaving client the attacker can pose as.\\nPR:N - OP_SETCLIENTID_CONFIRM is ALLOWED_WITHOUT_FH/ALLOWED_ON_ABSENT_FS, so no filehandle or export access check is performed, and under the default AUTH_SYS/AUTH_NULL flavors the RPC credentials are self-asserted and never verified. Any host able to reach the NFS port can reach the bug.\\nUI:N - The attack is completed entirely by the attacker\u0027s own NFS traffic; no victim opens a file, mounts a filesystem, or otherwise interacts. The concurrent client-expiry is a system/administrative state condition folded into Attack Complexity, not user interaction.\\nS:U - The corrupted object (struct nfs4_client) and all consequences remain within the kernel of the NFS server; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The freed struct nfs4_client is used after free (fsnotify_dentry, nfsd4_probe_callback) and its slab can be re-occupied by attacker-groomed data, giving a path to disclose arbitrary kernel memory. Per kernel scoring guidance a UAF is scored C:H.\\nI:H - The UAF yields concrete write primitives on freed memory \\u2014 set_bit() on cl_flags, memcpy() into cl_cb_conn, and an unbalanced atomic_dec() in put_client_renew_locked() \\u2014 plus a function-pointer dereference via nfsd4_run_cb(\u0026clp-\u003ecl_cb_null), which is exploitable for control-flow hijacking.\\nA:H - The use-after-free reliably oopses or panics the NFS server; additionally renew_client_locked() hits WARN_ON(1) (fatal with panic_on_warn) and the cl_rpc_users underflow to -1 leaves force_expire_client() stuck forever in wait_event, producing an unkillable hung task.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d20c11d86d8f821a64eac7d6c8f296f06d935f4f\", \"lessThan\": \"3f252a73e81aa01660cb426735eab932e6182e8d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d20c11d86d8f821a64eac7d6c8f296f06d935f4f\", \"lessThan\": \"d35ac850410966010e92f401f4e21868a9ea4d8b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d20c11d86d8f821a64eac7d6c8f296f06d935f4f\", \"lessThan\": \"f3aac6cf390d8b80e1d82975faf4ac61175519c0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d20c11d86d8f821a64eac7d6c8f296f06d935f4f\", \"lessThan\": \"22f45cedf281e6171817c8a3432c44d788c550e1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d20c11d86d8f821a64eac7d6c8f296f06d935f4f\", \"lessThan\": \"d71abd1ae4e0413707cd42b10c24a11d1aa71772\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d20c11d86d8f821a64eac7d6c8f296f06d935f4f\", \"lessThan\": \"74ad36ed60df561a303a19ecef400c7096b20306\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d20c11d86d8f821a64eac7d6c8f296f06d935f4f\", \"lessThan\": \"36e83eda90e0e4ac52f259f775b40b2841f8a0a3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d20c11d86d8f821a64eac7d6c8f296f06d935f4f\", \"lessThan\": \"571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d20c11d86d8f821a64eac7d6c8f296f06d935f4f\", \"lessThan\": \"908e4ead7f757504d8b345452730636e298cbf68\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfsd/nfs4state.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.297\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.241\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.190\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.149\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.103\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.43\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.15.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.16.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.16.*\"}, {\"status\": \"unaffected\", \"version\": \"6.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfsd/nfs4state.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8d\"}, {\"url\": \"https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8b\"}, {\"url\": \"https://git.kernel.org/stable/c/f3aac6cf390d8b80e1d82975faf4ac61175519c0\"}, {\"url\": \"https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1\"}, {\"url\": \"https://git.kernel.org/stable/c/d71abd1ae4e0413707cd42b10c24a11d1aa71772\"}, {\"url\": \"https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306\"}, {\"url\": \"https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3\"}, {\"url\": \"https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1\"}, {\"url\": \"https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()\\n\\nLei Lu recently reported that nfsd4_setclientid_confirm() did not check\\nthe return value from get_client_locked(). a SETCLIENTID_CONFIRM could\\nrace with a confirmed client expiring and fail to get a reference. That\\ncould later lead to a UAF.\\n\\nFix this by getting a reference early in the case where there is an\\nextant confirmed client. If that fails then treat it as if there were no\\nconfirmed client found at all.\\n\\nIn the case where the unconfirmed client is expiring, just fail and\\nreturn the result from get_client_locked().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.297\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.241\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.190\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.149\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.103\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.43\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.15.11\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.2\", \"versionStartIncluding\": \"3.17\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.17\", \"versionStartIncluding\": \"3.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:04:18.336Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-38724\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:04:18.336Z\", \"dateReserved\": \"2025-04-16T04:51:24.033Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-04T15:33:22.370Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.