CVE-2025-38724: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38724 Overview

CVE-2025-38724 is a use-after-free vulnerability [CWE-416] in the Linux kernel's NFS server (nfsd) subsystem. The flaw resides in nfsd4_setclientid_confirm(), which failed to check the return value of get_client_locked(). A SETCLIENTID_CONFIRM operation can race with a confirmed client that is expiring, causing the function to proceed without a valid client reference. This race condition can lead to a use-after-free (UAF) condition in kernel memory.

The vulnerability affects the Linux kernel across multiple stable branches and Debian Linux 11 distributions. The upstream fix acquires a reference early when an extant confirmed client is found, and gracefully handles cases where the unconfirmed client is expiring.

Critical Impact
A local, authenticated user on a system running a vulnerable Linux NFS server can trigger memory corruption via a race condition in nfsd4_setclientid_confirm(), potentially resulting in kernel-level code execution, privilege escalation, or system compromise.

Affected Products

Linux Kernel (multiple stable branches prior to the referenced fix commits)
Debian Linux 11
Siemens products bundling affected kernel versions (per Siemens ProductCERT advisories ssa-032379 and ssa-082556)

Discovery Timeline

Reporter - Vulnerability reported by Lei Lu (credited in the kernel commit message)
2025-09-04 - CVE CVE-2025-38724 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-38724

Vulnerability Analysis

The defect is a use-after-free triggered by a race condition in the NFSv4 server's client identification handling. When a client issues a SETCLIENTID_CONFIRM operation, nfsd4_setclientid_confirm() locates the corresponding confirmed client structure and previously assumed that get_client_locked() would always succeed in acquiring a reference.

However, get_client_locked() can fail if the target client is concurrently expiring. When the return value is not checked, the function proceeds to operate on a client structure whose reference was never taken. If the client is subsequently freed by the expiration path, subsequent dereferences access freed kernel memory, producing a UAF condition [CWE-416].

Successful exploitation from a local user with NFS client access impacts confidentiality, integrity, and availability at the kernel level.

Root Cause

The root cause is an unchecked return value from get_client_locked() inside nfsd4_setclientid_confirm(). The function assumed that once a confirmed client was located under the lookup lock, obtaining a reference would always succeed. This assumption is invalid because client expiration can interleave with the confirm path, leaving a window where the client structure is present but no longer reference-able.

Attack Vector

Exploitation requires local access with the ability to send NFSv4 protocol operations to a vulnerable nfsd instance. An attacker with low-privilege access on a system that can reach the NFS server crafts a workload that repeatedly triggers SETCLIENTID_CONFIRM requests while inducing client-expiry conditions. Winning the race causes the server thread to dereference freed memory in the client structure, enabling memory corruption primitives that can be shaped toward kernel-level code execution or privilege escalation.

No public proof-of-concept exploit has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-38724

Indicators of Compromise

Unexpected kernel oopses, KASAN reports, or panics referencing nfsd4_setclientid_confirm, get_client_locked, or nfs4_client structures in dmesg or /var/log/kern.log.
Abnormal volumes of NFSv4 SETCLIENTID_CONFIRM operations from a single client source, particularly interleaved with rapid client teardown patterns.
Unexplained nfsd thread crashes or NFS service restarts on exposed servers.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface use-after-free access patterns during regression testing.
Monitor kernel ring-buffer output for stack traces originating in the fs/nfsd/nfs4state.c code path.
Inventory hosts against fixed kernel commit hashes (22f45ced, 36e83eda, 3f252a73, 571a5e46, 74ad36ed, 908e4ead, d35ac850, d71abd1a, f3aac6cf) to identify unpatched systems.

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on nfsd crash signatures.
Track NFSv4 protocol telemetry for anomalous SETCLIENTID / SETCLIENTID_CONFIRM request rates per client.
Audit which local users and remote networks can reach the NFS server, and restrict exposure to trusted management ranges.

How to Mitigate CVE-2025-38724

Immediate Actions Required

Apply the vendor-supplied kernel update for your distribution as soon as it is available; Debian users should install the packages referenced in debian-lts-announce/2025/10/msg00007 and msg00008.
On Siemens-managed environments, follow the guidance in Siemens advisories SSA-032379 and SSA-082556.
Restrict access to the NFS server (TCP/UDP 2049) using host firewalls and network ACLs so only trusted clients can reach nfsd.
Reduce the local attack surface by limiting shell access on NFS servers to administrators.

Patch Information

The upstream fix acquires a client reference early when a confirmed client is found; if get_client_locked() fails, the code treats the situation as if no confirmed client existed. When the unconfirmed client is expiring, the function now returns the failure from get_client_locked() instead of proceeding. The change is available in the mainline and stable trees via commits 22f45ced, 36e83eda, 3f252a73, 571a5e46, 74ad36ed, 908e4ead, d35ac850, d71abd1a, and f3aac6cf.

Workarounds

If patching cannot be performed immediately, disable the NFS server (systemctl stop nfs-server && systemctl disable nfs-server) on hosts that do not require it.
Where NFS must remain online, constrain client connectivity to a small allow-list of trusted, patched clients via firewall rules.
Prefer NFSv3 or Kerberos-authenticated NFSv4 exports if operationally acceptable, and monitor for anomalous client-identity churn.

bash

# Verify running kernel version and NFS server status
uname -r
systemctl status nfs-server

# Restrict nfsd to trusted subnet using nftables (example)
nft add rule inet filter input tcp dport 2049 ip saddr != 10.10.0.0/24 drop
nft add rule inet filter input udp dport 2049 ip saddr != 10.10.0.0/24 drop

# Apply distribution updates (Debian example)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/[^-]*-[^-]*-//')
sudo reboot