CVE-2025-38724
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In the Linux kernel, the NFS server (nfsd) function nfsd4_setclientid_confirm() does not check the return value of get_client_locked(). A race with an expiring client can lead to use-after-free (UAF).
Risk Assessment
This may lead to NFS server crashes or potential arbitrary code execution by an attacker.
Recommendation
Apply the patch that adds a check of the return value of get_client_locked() and proper error handling.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().