CVE-2025-38724
Estado: ModificadaAlta (7.8)—
In the Linux kernel, the following vulnerability has been resolved:
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()
Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF.
Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all.
In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.39%
- Percentil entre todas las CVEs puntuadas: 31
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation85 % - Impacto principal
T1059Command and Scripting Interpreterexecution75 %
Vulnerabilidad local (AV:L/PR:L) de use-after-free (CWE-416) en nfsd que permite ejecución de código con privilegios elevados tras ganar una carrera de referencias.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (2)
CWE
- CWE-416
Referencias
- https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1
- https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3
- https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8d
- https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1
- https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306
- https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68
- https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8b
- https://git.kernel.org/stable/c/d71abd1ae4e0413707cd42b10c24a11d1aa71772
- https://git.kernel.org/stable/c/f3aac6cf390d8b80e1d82975faf4ac61175519c0
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-38724",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-38724",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-06-10T20:40:31.454640Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
"lessThan": "3f252a73e81aa01660cb426735eab932e6182e8d",
"versionType": "git"
},
{
"status": "affected",
"version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
"lessThan": "d35ac850410966010e92f401f4e21868a9ea4d8b",
"versionType": "git"
},
{
"status": "affected",
"version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
"lessThan": "f3aac6cf390d8b80e1d82975faf4ac61175519c0",
"versionType": "git"
},
{
"status": "affected",
"version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
"lessThan": "22f45cedf281e6171817c8a3432c44d788c550e1",
"versionType": "git"
},
{
"status": "affected",
"version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
"lessThan": "d71abd1ae4e0413707cd42b10c24a11d1aa71772",
"versionType": "git"
},
{
"status": "affected",
"version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
"lessThan": "74ad36ed60df561a303a19ecef400c7096b20306",
"versionType": "git"
},
{
"status": "affected",
"version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
"lessThan": "36e83eda90e0e4ac52f259f775b40b2841f8a0a3",
"versionType": "git"
},
{
"status": "affected",
"version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
"lessThan": "571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1",
"versionType": "git"
},
{
"status": "affected",
"version": "d20c11d86d8f821a64eac7d6c8f296f06d935f4f",
"lessThan": "908e4ead7f757504d8b345452730636e298cbf68",
"versionType": "git"
}
],
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.297",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.241",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.190",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.149",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.103",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.43",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.15.11",
"versionType": "semver",
"lessThanOrEqual": "6.15.*"
},
{
"status": "unaffected",
"version": "6.16.2",
"versionType": "semver",
"lessThanOrEqual": "6.16.*"
},
{
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/nfsd/nfs4state.c"
],
"defaultStatus": "affected"
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "SIMATIC CN 4100",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V5.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"versions": [
{
"status": "affected",
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"versions": [
{
"status": "affected",
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"versions": [
{
"status": "affected",
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"versions": [
{
"status": "affected",
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"versions": [
{
"status": "affected",
"version": "V3.1.5",
"lessThan": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2025-09-04T16:15:42.273",
"references": [
{
"url": "https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8d",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8b",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d71abd1ae4e0413707cd42b10c24a11d1aa71772",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f3aac6cf390d8b80e1d82975faf4ac61175519c0",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()\n\nLei Lu recently reported that nfsd4_setclientid_confirm() did not check\nthe return value from get_client_locked(). a SETCLIENTID_CONFIRM could\nrace with a confirmed client expiring and fail to get a reference. That\ncould later lead to a UAF.\n\nFix this by getting a reference early in the case where there is an\nextant confirmed client. If that fails then treat it as if there were no\nconfirmed client found at all.\n\nIn the case where the unconfirmed client is expiring, just fail and\nreturn the result from get_client_locked()."
}
],
"lastModified": "2026-07-30T06:23:37.427",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "95A259CB-F924-46C0-8BCA-6226A6D466B2",
"versionEndExcluding": "5.4.297",
"versionStartIncluding": "3.17"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0D21C35-EB8A-488A-BBF9-403E4817E5DD",
"versionEndExcluding": "5.10.241",
"versionStartIncluding": "5.5"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD9E597F-3DDE-4D7E-976C-463D0611F13F",
"versionEndExcluding": "5.15.190",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8",
"versionEndExcluding": "6.1.149",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48",
"versionEndExcluding": "6.6.103",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "472C5F87-2BF3-4FAB-9B21-DA7513977363",
"versionEndExcluding": "6.12.43",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977",
"versionEndExcluding": "6.15.11",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899",
"versionEndExcluding": "6.16.2",
"versionStartIncluding": "6.16"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}