In the Linux kernel, the following vulnerability has been resolved:
nfsd: handle getclientlocked() failure in nfsd4setclientidconfirm()
Lei Lu recently reported that nfsd4setclientidconfirm() did not check the return value from getclientlocked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF.
Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all.
In the case where the unconfirmed client is expiring, just fail and return the result from getclientlocked().
[
{
"signature_type": "Function",
"digest": {
"function_hash": "1587117887915349411233122205001606589",
"length": 1606.0
},
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"signature_version": "v1",
"id": "CVE-2025-38724-18c99be2",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d35ac850410966010e92f401f4e21868a9ea4d8b"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
]
},
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"signature_version": "v1",
"id": "CVE-2025-38724-1db4df7e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d71abd1ae4e0413707cd42b10c24a11d1aa71772"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
]
},
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"signature_version": "v1",
"id": "CVE-2025-38724-3fd4d7d3",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22f45cedf281e6171817c8a3432c44d788c550e1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
]
},
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"signature_version": "v1",
"id": "CVE-2025-38724-4219146a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3aac6cf390d8b80e1d82975faf4ac61175519c0"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
]
},
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"signature_version": "v1",
"id": "CVE-2025-38724-428cc5c7",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74ad36ed60df561a303a19ecef400c7096b20306"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1587117887915349411233122205001606589",
"length": 1606.0
},
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"signature_version": "v1",
"id": "CVE-2025-38724-62327a26",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3aac6cf390d8b80e1d82975faf4ac61175519c0"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1587117887915349411233122205001606589",
"length": 1606.0
},
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"signature_version": "v1",
"id": "CVE-2025-38724-6aa203fd",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74ad36ed60df561a303a19ecef400c7096b20306"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "211403229764134293871978933805373568294",
"length": 1436.0
},
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"signature_version": "v1",
"id": "CVE-2025-38724-72c2c939",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f252a73e81aa01660cb426735eab932e6182e8d"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
]
},
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"signature_version": "v1",
"id": "CVE-2025-38724-8f5b452b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@908e4ead7f757504d8b345452730636e298cbf68"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"65078790122563124015889328768858380612",
"223228841131649122246881251840588600550",
"213938546263833708421309658532511593749",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"45318745835166383452092042300309112315",
"112965501114412259387006816660574053417"
]
},
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"signature_version": "v1",
"id": "CVE-2025-38724-931a00e0",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f252a73e81aa01660cb426735eab932e6182e8d"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
]
},
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"signature_version": "v1",
"id": "CVE-2025-38724-b6897bdf",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d35ac850410966010e92f401f4e21868a9ea4d8b"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1587117887915349411233122205001606589",
"length": 1606.0
},
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"signature_version": "v1",
"id": "CVE-2025-38724-bda3eb37",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1587117887915349411233122205001606589",
"length": 1606.0
},
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"signature_version": "v1",
"id": "CVE-2025-38724-d745e003",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22f45cedf281e6171817c8a3432c44d788c550e1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"205320510678558902474967099373612906486",
"161657209163796829197865952529151577459",
"102320484217446627085248183632313738114",
"179619607019328616365974604799307787170",
"63694459574733555125088298439051141668",
"83178231123299071826053049520702447047",
"35227558630485020237288867774506263488",
"236730270675213621108880353087007655990",
"177945871879018094692216989077679007271",
"160976622671489191885371359524128973694",
"96833906055299041425467904925062457728",
"253765341513586590373115179329314541524",
"70559075232637131705471722843175856591",
"276092598569047347854922177625826919727",
"149396648857785085884536788789106043674"
]
},
"target": {
"file": "fs/nfsd/nfs4state.c"
},
"signature_version": "v1",
"id": "CVE-2025-38724-e3bf2c57",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1587117887915349411233122205001606589",
"length": 1606.0
},
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"signature_version": "v1",
"id": "CVE-2025-38724-fbaf2d3b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d71abd1ae4e0413707cd42b10c24a11d1aa71772"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1587117887915349411233122205001606589",
"length": 1606.0
},
"target": {
"file": "fs/nfsd/nfs4state.c",
"function": "nfsd4_setclientid_confirm"
},
"signature_version": "v1",
"id": "CVE-2025-38724-fdd2762b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@908e4ead7f757504d8b345452730636e298cbf68"
}
]