Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s NFS server can crash the affected system when callback setup proceeds without an available backchannel session. The supplied CVSS score is 7.5, reflecting remotely reachable availability impact without required privileges or user interaction. The sources identify no confidentiality or integrity impact.
Executive priority
Treat this as a high-priority availability issue for exposed or critical NFS servers. Schedule prompt kernel updates and restarts through normal change control. Risk is lower where NFSD is disabled or inaccessible, but the supplied evidence does not establish active exploitation or data compromise.
Technical view
In nfsd4_process_cb_update(), the session pointer starts as NULL. If __nfsd4_find_backchannel() finds no usable backchannel session, setup_callback_client() dereferences that NULL pointer, causing a kernel fault. This is CWE-476 and affects availability. Upstream stable commits resolve the condition across supported kernel branches.
Likely exposure
Exposure is most likely on Linux systems running the NFSD service with an affected kernel and using the relevant NFS callback/backchannel functionality. Systems not acting as NFS servers are less likely to reach this code. The supplied version list is ambiguous, so validate distribution kernel packages rather than relying only on upstream version numbers.
Exploitation context
The supplied CVSS vector describes network reachability, low attack complexity, no privileges, and no user interaction, with availability impact only. However, the bundle provides no evidence of public exploitation or exploit availability, and marks the CVE as absent from KEV. Do not treat active exploitation as established.
Researcher notes
The root cause and failure path are clearly described, but the supplied affected-version representation is flattened and includes repeated commit identifiers. Establish exact exposure through distribution package advisories and upstream branch-specific commits. The bundle does not provide proof-of-concept details, observed attacks, or a confirmed exploitation timeline.
Mitigation direction
- Install a vendor-supported kernel package that incorporates the applicable upstream stable fix.
- Restart into the updated kernel; installing a package alone may leave the vulnerable kernel running.
- Review distribution security guidance for affected package versions and any vendor-approved temporary mitigations.
- Prioritize externally reachable or business-critical NFS servers where a crash would disrupt operations.
Validation and detection
- Inventory Linux hosts running NFSD and record their active kernel package and build.
- Compare each active kernel package against its distribution advisory and the referenced upstream stable fixes.
- After updating and restarting, confirm the running kernel is the remediated build.
- Review kernel logs and monitoring for NFSD-related NULL dereferences, faults, crashes, or unexpected restarts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-53217 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/d9a0d1f6e15859ea7a86a327f28491e23deaaa62CVE reference, Linux
- https://git.kernel.org/stable/c/cac1405e3ff6685a438e910ad719e0cf06af90eeCVE reference, Linux
- https://git.kernel.org/stable/c/752a75811f27300fe8131b0a1efc91960f6f88e7CVE reference, Linux
- https://git.kernel.org/stable/c/c5d90f9302742985a5078e42ac38de42c364c44aCVE reference, Linux
- https://git.kernel.org/stable/c/0c3b0e326f838787d229314d4de83af9c53347e8CVE reference, Linux
- https://git.kernel.org/stable/c/eb51733ae5fc73d95bd857d5da26f9f65b202a79CVE reference, Linux
- https://git.kernel.org/stable/c/03178cd8f67227015debb700123987fe96275cd1CVE reference, Linux
- https://git.kernel.org/stable/c/4a4ffc1aa9d618e41ad9151f40966e402e58a5a2CVE reference, Linux
- https://git.kernel.org/stable/c/1e02c641c3a43c88cecc08402000418e15578d38CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.