#VU106803 Improper locking in Linux kernel - CVE-2025-21900

Vulnerability identifier: #VU106803

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-21900

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nfs4_atomic_open() function in fs/nfs/nfs4proc.c, within the nfs4_inode_return_delegation() function in fs/nfs/delegation.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.13, 6.13.1, 6.13.2, 6.13.3, 6.13.4, 6.13.5

---

External links
https://git.kernel.org/stable/c/4fe4ae6c2e01d028856b73b6328b12b8945df871
https://git.kernel.org/stable/c/8f8df955f078e1a023ee55161935000a67651f38
https://git.kernel.org/stable/c/f41a60bc43e7abbc636fee78bed0d74c31e738b0
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.6

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.