In the Linux kernel, the following vulnerability has been resolved:
nfsd: handle getclientlocked() failure in nfsd4setclientidconfirm()
Lei Lu recently reported that nfsd4setclientidconfirm() did not check the return value from getclientlocked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF.
Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all.
In the case where the unconfirmed client is expiring, just fail and return the result from getclientlocked().
[
{
"id": "CVE-2025-38724-18c99be2",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d35ac850410966010e92f401f4e21868a9ea4d8b",
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1606.0,
"function_hash": "1587117887915349411233122205001606589"
}
},
{
"id": "CVE-2025-38724-1db4df7e",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d71abd1ae4e0413707cd42b10c24a11d1aa71772",
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38724-3fd4d7d3",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22f45cedf281e6171817c8a3432c44d788c550e1",
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38724-4219146a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3aac6cf390d8b80e1d82975faf4ac61175519c0",
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38724-428cc5c7",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74ad36ed60df561a303a19ecef400c7096b20306",
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38724-62327a26",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3aac6cf390d8b80e1d82975faf4ac61175519c0",
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1606.0,
"function_hash": "1587117887915349411233122205001606589"
}
},
{
"id": "CVE-2025-38724-6aa203fd",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74ad36ed60df561a303a19ecef400c7096b20306",
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1606.0,
"function_hash": "1587117887915349411233122205001606589"
}
},
{
"id": "CVE-2025-38724-72c2c939",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f252a73e81aa01660cb426735eab932e6182e8d",
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1436.0,
"function_hash": "211403229764134293871978933805373568294"
}
},
{
"id": "CVE-2025-38724-8f5b452b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@908e4ead7f757504d8b345452730636e298cbf68",
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38724-931a00e0",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f252a73e81aa01660cb426735eab932e6182e8d",
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"65078790122563124015889328768858380612",
"223228841131649122246881251840588600550",
"213938546263833708421309658532511593749",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"45318745835166383452092042300309112315",
"112965501114412259387006816660574053417"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38724-b6897bdf",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d35ac850410966010e92f401f4e21868a9ea4d8b",
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38724-b916ac2b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36e83eda90e0e4ac52f259f775b40b2841f8a0a3",
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38724-bda3eb37",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1",
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1606.0,
"function_hash": "1587117887915349411233122205001606589"
}
},
{
"id": "CVE-2025-38724-d745e003",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22f45cedf281e6171817c8a3432c44d788c550e1",
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1606.0,
"function_hash": "1587117887915349411233122205001606589"
}
},
{
"id": "CVE-2025-38724-dcd33859",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36e83eda90e0e4ac52f259f775b40b2841f8a0a3",
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1606.0,
"function_hash": "1587117887915349411233122205001606589"
}
},
{
"id": "CVE-2025-38724-e3bf2c57",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1",
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38724-fbaf2d3b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d71abd1ae4e0413707cd42b10c24a11d1aa71772",
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1606.0,
"function_hash": "1587117887915349411233122205001606589"
}
},
{
"id": "CVE-2025-38724-fdd2762b",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@908e4ead7f757504d8b345452730636e298cbf68",
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1606.0,
"function_hash": "1587117887915349411233122205001606589"
}
}
]