Improper locking in Linux kernel nfsd



| Updated: 2025-05-10
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2025-37871
CWE-ID CWE-667
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Improper locking

EUVDB-ID: #VU108876

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-37871

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nfsd_break_one_deleg() function in fs/nfsd/nfs4state.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.1 - 6.1.134

CPE2.3 External links

https://git.kernel.org/stable/c/14985d66b9b99c12995dd99d1c6c8dec4114c2a5
https://git.kernel.org/stable/c/7d192e27a431026c58d60edf66dc6cd98d0c01fc
https://git.kernel.org/stable/c/a1d14d931bf700c1025db8c46d6731aa5cf440f9
https://git.kernel.org/stable/c/a70832d3555987035fc430ccd703acd89393eadb
https://git.kernel.org/stable/c/a7fce086f6ca84db409b9d58493ea77c1978897c
https://git.kernel.org/stable/c/b9bbe8f9d5663311d06667ce36d6ed255ead1a26
https://git.kernel.org/stable/c/ba903539fff745d592d893c71b30e5e268a95413
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.135


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###