Bug 2393172 (CVE-2025-38724)

Summary:	CVE-2025-38724 kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A vulnerability has been identified in the Linux kernel's Network File System (NFS) daemon that could allow for a Denial of Service and in worst case scenario Arbitrary Code Execution. This Use-After-Free flaw arises from a race condition when the kernel handles the confirmation of an NFS client identifier. If an NFS client is expiring while this confirmation is in progress, the system can attempt to use memory that is no longer allocated.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-09-04 16:02:39 UTC

In the Linux kernel, the following vulnerability has been resolved:

nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

Lei Lu recently reported that nfsd4_setclientid_confirm() did not check
the return value from get_client_locked(). a SETCLIENTID_CONFIRM could
race with a confirmed client expiring and fail to get a reference. That
could later lead to a UAF.

Fix this by getting a reference early in the case where there is an
extant confirmed client. If that fails then treat it as if there were no
confirmed client found at all.

In the case where the unconfirmed client is expiring, just fail and
return the result from get_client_locked().

Comment 1 Jon Moroney 2025-09-04 18:24:59 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025090401-CVE-2025-38724-5309@gregkh/T

Comment 4 errata-xmlrpc 2025-12-01 05:25:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:22387 https://access.redhat.com/errata/RHSA-2025:22387

Comment 5 errata-xmlrpc 2025-12-01 05:58:42 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:22388 https://access.redhat.com/errata/RHSA-2025:22388

Comment 6 errata-xmlrpc 2025-12-01 09:21:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:22395 https://access.redhat.com/errata/RHSA-2025:22395

Comment 7 errata-xmlrpc 2025-12-01 09:48:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2025:22392 https://access.redhat.com/errata/RHSA-2025:22392

Comment 8 errata-xmlrpc 2025-12-01 10:39:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:22405 https://access.redhat.com/errata/RHSA-2025:22405

Comment 9 errata-xmlrpc 2025-12-02 10:57:15 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2025:22571 https://access.redhat.com/errata/RHSA-2025:22571

Comment 10 errata-xmlrpc 2025-12-10 00:49:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:23000 https://access.redhat.com/errata/RHSA-2025:23000

Comment 11 errata-xmlrpc 2025-12-17 07:45:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:23445 https://access.redhat.com/errata/RHSA-2025:23445

Comment 12 errata-xmlrpc 2025-12-17 15:00:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:23463 https://access.redhat.com/errata/RHSA-2025:23463