CVE-2025-38724

Vulnerability

CVE-2025-38724 is a use-after-free vulnerability in the Linux kernel's NFSv4 server (nfsd). The function nfsd4_setclientid_confirm() fails to check the return value of get_client_locked(). If a SETCLIENTID_CONFIRM request races with the expiration of a confirmed client, the function may operate on a freed client structure, leading to a use-after-free condition.

Exploitation

Exploitation requires the ability to send NFSv4 SETCLIENTID_CONFIRM commands to the target system. An attacker must be able to trigger the race condition between the confirmation and client expiration. This can be done locally or remotely if NFSv4 is accessible over the network. No special privileges are needed beyond network access to the NFS server.

Impact

A successful exploit could crash the system or potentially allow an attacker to escalate privileges, as the use-after-free may be leveraged for arbitrary code execution within the kernel.

Mitigation

The vulnerability is fixed in Linux kernel commits [3] and [4]. Users should apply the latest kernel updates from their distribution or compile a patched kernel. Siemens also lists affected products in advisories [1] and [2] that require firmware updates.