Security readout for executives and security teams
Plain-English summary
A flaw in the Linux NFSv4 server can delay callback shutdown for roughly 15 minutes when a client is in courtesy state. The primary impact is reduced availability; the supplied CVSS assessment is 7.5. Systems not providing NFS services are unlikely to be exposed through this component.
Executive priority
Treat this as a high-priority availability issue for business-critical NFSv4 servers, especially shared storage supporting production workloads. Patch through normal emergency or accelerated maintenance processes after confirming exposure. Lower the priority for systems where NFSD is absent or disabled.
Technical view
NFSD may attempt a callback for an NFSv4 client in courtesy state, leaving cl_cb_inflight nonzero and hanging nfsd4_shutdown_callback until TCP reports the dropped connection. The kernel fix changes nfsd4_run_cb_work to skip that RPC call. No confidentiality or integrity impact is identified in the supplied CVSS vector.
Likely exposure
Exposure is concentrated in Linux systems running the NFSv4 server on affected kernels. The bundle lists several affected upstream releases, but distribution kernels may contain backported fixes despite older version numbers. Confirm package status through the relevant vendor advisory rather than relying only on uname output.
Exploitation context
The supplied record rates the issue as network-accessible, low-complexity, unauthenticated, and availability-only. However, it provides no public exploit evidence or precise attacker-controlled trigger sequence. The CVE is not listed as KEV in the bundle, so active exploitation is not established.
Researcher notes
The described failure is a shutdown-path hang caused by callback accounting remaining active for a courtesy-state client. The fix avoids initiating the RPC in that state. Source evidence supports an approximately 15-minute delay, but does not establish repeatable malicious exploitation, service-wide outage scope, or observed attacks.
Mitigation direction
- Install the vendor kernel update containing the NFSD callback fix.
- Prioritize internet-facing or broadly reachable NFSv4 servers.
- Restrict NFS access to required clients and trusted network segments.
- If patching is delayed, consult vendor guidance for supported temporary mitigations.
Validation and detection
- Inventory systems running or configured to run the Linux NFS server.
- Compare installed kernel packages with distribution and appliance vendor advisories.
- Confirm the deployed kernel includes the applicable stable fix or vendor backport.
- Review NFS service logs and operations for callback-shutdown delays or prolonged hangs.
- After updating, verify the corrected kernel is running following any required reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-21795 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/abed68027ea3ab893ac85cc46a00e2e64a324239CVE reference, Linux
- https://git.kernel.org/stable/c/efa8a261c575f816c7e79a87aeb3ef8a0bd6b221CVE reference, Linux
- https://git.kernel.org/stable/c/38d345f612503b850c2973e5a879f88e441b34d7CVE reference, Linux
- https://git.kernel.org/stable/c/23ad7797c74cd8f7f90617f1e59a8703e2b43908CVE reference, Linux
- https://git.kernel.org/stable/c/cedfbb92cf97a6bff3d25633001d9c44442ee854CVE reference, Linux
- https://git.kernel.org/stable/c/e88d2451cd42e025465d6b51fd716a47b0b3800dCVE reference, Linux
- https://git.kernel.org/stable/c/036ac2778f7b28885814c6fbc07e156ad1624d03CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.