Security readout for executives and security teams
Plain-English summary
Linux systems using NFS may process an uninitialized value while decoding file attributes. The supplied record rates this critical at CVSS 9.8, but the public evidence documents a sanitizer warning rather than demonstrated compromise. The kernel fix initializes the affected field to NULL.
Executive priority
Promptly assess and patch NFS-using Linux systems under normal critical-kernel-update procedures. The 9.8 rating warrants accelerated triage, but there is no cited active exploitation and the demonstrated behavior is a sanitizer warning. Avoid treating the score alone as proof of imminent remote compromise.
Technical view
The NFS client function decode_getfattr_attrs() can pass an uninitialized fattr->mdsthreshold field into decode_attr_mdsthreshold(). KMSAN detected the condition during NFSv4 attribute processing. The upstream correction initializes mdsthreshold to NULL in nfs_fattr_init(). The sources do not establish a reliable code-execution or data-corruption primitive.
Likely exposure
Potential exposure is limited to Linux systems running affected kernel builds and exercising NFS client attribute decoding. The supplied version data lacks clear affected and fixed ranges, while distributions may backport fixes. Determine status from vendor kernel advisories and fix-commit mappings rather than version numbers alone.
Exploitation context
The bundle marks this CVE as absent from KEV and cites no active exploitation or public proof of concept. The CVSS vector describes network reachability without privileges or user interaction, but available technical evidence only demonstrates an uninitialized-value warning. Practical impact remains insufficiently established.
Researcher notes
The trace reaches decode_getfattr_attrs() through NFSv4 GETATTR, inode revalidation, access checking, and stat-related paths. The stated defect is missing initialization of mdsthreshold, corrected by assigning NULL. Exact version boundaries are ambiguous in the supplied record, and no cited evidence demonstrates attacker-controlled corruption, information disclosure, or execution.
Mitigation direction
- Apply a distribution kernel update incorporating the applicable upstream stable fix.
- Use vendor advisories to determine fixed package versions and backport status.
- Prioritize systems using NFS, particularly those communicating with less-trusted NFS services.
- Reboot updated systems so the corrected kernel is actively running.
Validation and detection
- Inventory active kernel builds and identify systems configured as NFS clients.
- Map each vendor kernel build to the applicable listed stable fix commit.
- Confirm the running kernel initializes fattr->mdsthreshold to NULL in nfs_fattr_init().
- Review kernel or sanitizer logs for decode_getfattr_attrs warnings; their absence does not prove safety.
Public sources used
- CVE Program record
- CVE List V5 record
- Linux stable fix 25ffd294
- Linux stable fix bbfcd261
- Linux stable fix 8fc5ea92
- Linux stable fix 9b453e8b
- Linux stable fix f6b2b2b9
- Linux stable fix f749cb60
- Linux stable fix 9be0a21a
- Linux stable fix dc270d71
- Debian LTS advisory, March 2025
- Debian LTS advisory, January 2025
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-908: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-53066 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/25ffd294fef81a7f3cd9528adf21560c04d98747CVE reference, Linux
- https://git.kernel.org/stable/c/bbfcd261cc068fe1cd02a4e871275074a0daa4e2CVE reference, Linux
- https://git.kernel.org/stable/c/8fc5ea9231af9122d227c9c13f5e578fca48d2e3CVE reference, Linux
- https://git.kernel.org/stable/c/9b453e8b108a5a93a6e348cf2ba4c9c138314a00CVE reference, Linux
- https://git.kernel.org/stable/c/f6b2b2b981af8e7d7c62d34143acefa4e1edfe8bCVE reference, Linux
- https://git.kernel.org/stable/c/f749cb60a01f8391c760a1d6ecd938cadacf9549CVE reference, Linux
- https://git.kernel.org/stable/c/9be0a21ae52b3b822d0eec4d14e909ab394f8a92CVE reference, Linux
- https://git.kernel.org/stable/c/dc270d7159699ad6d11decadfce9633f0f71c1dbCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Uninitialized Resource
Use of Uninitialized Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.