Linux Kernel Vulnerability in NFS Daemon Handling Client ID Confirmation

CVE-2025-38724

What is CVE-2025-38724?

A flaw in the Linux kernel's NFS daemon handling of client ID confirmations has been identified, where the function nfsd4_setclientid_confirm() inadequately checks the result from get_client_locked(). This oversight may lead to a race condition between a SETCLIENTID_CONFIRM and a confirmed client’s expiration, potentially resulting in use-after-free scenarios. The vulnerability has been rectified by ensuring early reference acquisition in circumstances where a confirmed client exists. If that process fails, the system will treat it as if no confirmed client was present. In instances where unconfirmed clients are expiring, the function now properly fails and returns the result from get_client_locked() as intended.

References