LiveActive security incident?Get immediate response
CVE Record

CVE-2025-38724: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2025-38724 is a Linux kernel NFS server bug. A race during NFSv4 client confirmation can leave the kernel using a client object after it should no longer be valid. The public record does not provide a CVSS score or confirmed exploitation, so urgency depends on whether affected systems expose nfsd/NFSv4.

Executive priority

Treat as a targeted patching priority for servers that provide NFS. It is not currently supported as emergency internet-wide exploitation, but kernel use-after-free flaws in network services deserve timely remediation where NFS is enabled.

Technical view

In nfsd4_setclientid_confirm(), get_client_locked() could fail when SETCLIENTID_CONFIRM races with expiry of a confirmed or unconfirmed client. Missing handling could later lead to a use-after-free. Kernel stable commits fix this by taking a reference earlier or returning failure when the client is expiring.

Likely exposure

Exposure is most likely on Linux systems running affected kernel versions with the in-kernel NFS server enabled, particularly NFSv4 service reachable by clients. Systems not using nfsd are less likely to be exposed. Exact distribution package impact should be confirmed through vendor advisories.

Exploitation context

The source bundle shows no CISA KEV listing and provides no cited evidence of active exploitation or public exploit tooling. The issue appears race-condition dependent in NFSv4 client state handling. Public sources describe the bug class and fix, not a practical exploitation path.

Researcher notes

Key evidence is the Linux kernel CVE text and stable commit references. The bundle lacks CVSS, CWE, detailed impact rating, exploit prerequisites, and full affected range semantics. Avoid assuming code execution; validate impact against downstream vendor advisories and kernel commit history.

Mitigation direction

  • Apply kernel updates containing the referenced stable fixes.
  • Review Debian LTS and vendor advisories for packaged kernel status.
  • Disable or restrict NFS server exposure where it is not required.
  • Limit NFS access to trusted networks and clients.
  • Check Siemens advisories if using affected Siemens products.

Validation and detection

  • Inventory Linux hosts running nfsd or NFSv4 services.
  • Map running kernel versions to vendor fixed package versions.
  • Confirm the relevant stable commit or vendor patch is present.
  • Review NFS exposure from untrusted networks.
  • Monitor kernel logs for nfsd instability or crashes.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-38724 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
3ADP providers
14Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd20c11d86d8f821a64eac7d6c8f296f06d935f4f, d20c11d86d8f821a64eac7d6c8f296f06d935f4f, d20c11d86d8f821a64eac7d6c8f296f06d935f4f, d20c11d86d8f821a64eac7d6c8f296f06d935f4f, d20c11d86d8f821a64eac7d6c8f296f06d935f4f, d20c11d86d8f821a64eac7d6c8f296f06d935f4f, d20c11d86d8f821a64eac7d6c8f296f06d935f4f, d20c11d86d8f821a64eac7d6c8f296f06d935f4f, d20c11d86d8f821a64eac7d6c8f296f06d935f4funaffected
LinuxLinux3.17, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.