VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Feb 27, 2025· Updated May 12, 2026

CVE-2025-21795

CVE-2025-21795

Description

In the Linux kernel, the following vulnerability has been resolved:

NFSD: fix hang in nfsd4_shutdown_callback

If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is not 0. This hang lasts about 15 minutes until TCP notifies NFSD that the connection was dropped.

This patch modifies nfsd4_run_cb_work to skip the RPC call if nfs4_client is in courtesy state.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

NFSD callback hang during shutdown when client in courtesy state causes 15-minute delay; fix skips callback for courtesy clients.

Root

Cause The NFS server's callback mechanism incorrectly attempts to send a callback to an NFS client that is in the "courtesy" state. During shutdown (nfsd4_shutdown_callback), the callback work item is still pending (cl_cb_inflight non-zero) even though the client no longer requires callback completion. This causes a hang of approximately 15 minutes until the TCP connection times out. The Linux kernel fix modifies nfsd4_run_cb_work to skip the RPC call when the client is in courtesy state. [3][4]

Exploitation

No special authentication or network position is required beyond having an NFS client that enters the courtesy state (e.g., after a client disconnection). The hang occurs on the server side, affecting all NFSv4.1+ services served by the same NFS daemon. Any NFS client that transitions to courtesy state can trigger the condition, making it a denial-of-service vector against the NFS server.

Impact

An attacker with the ability to bring an NFS client into a courtesy state (or cause such a state transition) can cause the NFS server to hang for the duration of the TCP timeout (approximately 15 minutes). This effectively denies service to all clients. The vulnerability has a CVSS score of 5.5 (Medium), reflecting the availability impact.

Mitigation

The fix has been included in the Linux kernel stable branches. Affected versions are all kernels without the patch. Additionally, Siemens lists this CVE in advisories affecting products using Linux, such as the SIMATIC S7-1500 family with GNU/Linux subsystem (see [1] and [2]). Users should apply the latest kernel updates or vendor patches to remediate.

References
  1. SSA-082556
  2. SSA-265688
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

139

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.