Linux Kernel NFS Client Callback Issue in NFSD

CVE-2025-21795

Summary

A vulnerability in the Linux kernel's NFSD can cause a hang during the nfsd4_shutdown_callback, particularly when the nfs4_client is in a courtesy state. This issue arises because the callback attempt remains in progress due to cl_cb_inflight not being zero, resulting in a prolonged hang of approximately 15 minutes until the TCP layer drops the connection. This vulnerability has been addressed by modifying the nfsd4_run_cb_work function to bypass the RPC call when the nfs4_client is in courtesy state, thereby enhancing overall system stability and performance.

References