CVE-2025-21900 (GCVE-0-2025-21900)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:26 – Updated: 2026-08-05 11:55
VLAI
Title
NFSv4: Fix a deadlock when recovering state on a sillyrenamed file
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a deadlock when recovering state on a sillyrenamed file If the file is sillyrenamed, and slated for delete on close, it is possible for a server reboot to triggeer an open reclaim, with can again race with the application call to close(). When that happens, the call to put_nfs_open_context() can trigger a synchronous delegreturn call which deadlocks because it is not marked as privileged. Instead, ensure that the call to nfs4_inode_return_delegation_on_close() catches the delegreturn, and schedules it asynchronously.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: adb4b42d19aea91826621a8d0bac94cf2c08f8bc , < 4fe4ae6c2e01d028856b73b6328b12b8945df871 (git)
Affected: adb4b42d19aea91826621a8d0bac94cf2c08f8bc , < f41a60bc43e7abbc636fee78bed0d74c31e738b0 (git)
Affected: adb4b42d19aea91826621a8d0bac94cf2c08f8bc , < 8f8df955f078e1a023ee55161935000a67651f38 (git)
Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.18 , ≤ 6.12.* (semver)
Unaffected: 6.13.6 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21900",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:18:02.848036Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-667",
                "description": "CWE-667 Improper Locking",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:18:05.662Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/delegation.c",
            "fs/nfs/delegation.h",
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4fe4ae6c2e01d028856b73b6328b12b8945df871",
              "status": "affected",
              "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc",
              "versionType": "git"
            },
            {
              "lessThan": "f41a60bc43e7abbc636fee78bed0d74c31e738b0",
              "status": "affected",
              "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc",
              "versionType": "git"
            },
            {
              "lessThan": "8f8df955f078e1a023ee55161935000a67651f38",
              "status": "affected",
              "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/delegation.c",
            "fs/nfs/delegation.h",
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.18",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix a deadlock when recovering state on a sillyrenamed file\n\nIf the file is sillyrenamed, and slated for delete on close, it is\npossible for a server reboot to triggeer an open reclaim, with can again\nrace with the application call to close(). When that happens, the call\nto put_nfs_open_context() can trigger a synchronous delegreturn call\nwhich deadlocks because it is not marked as privileged.\n\nInstead, ensure that the call to nfs4_inode_return_delegation_on_close()\ncatches the delegreturn, and schedules it asynchronously."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - This is NFSv4 client code whose vulnerable path is entered only in response to remote server behaviour \u2014 a server reboot/session reset (NFS4ERR_STALE_CLIENTID, NFS4ERR_BAD_SESSION, lease expiry) drives the state manager into open reclaim, and the blocking DELEGRETURN is an RPC to that server. A malicious or compromised NFS server, or an on-path attacker on a typical AUTH_SYS mount, can force state recovery at will over the network.\nAC:L - This is not a tight instruction-level race: the state manager holds the open-context reference across a full OPEN reclaim round trip whose duration the server chooses, and it can be stretched further with NFS4ERR_DELAY/NFS4ERR_GRACE, so the attacker controls the window width and can force recovery repeatedly until the race lands. The other side \u2014 an open, unlinked (sillyrenamed) file being closed \u2014 is ubiquitous in normal workloads (tmpfile(), mkstemp+unlink, editors, build systems, mail spools).\nPR:N - The attacker is the remote NFS server (or an on-path attacker) and needs no credentials or account on the victim client; the mount is a pre-existing deployment condition. Even under a purely local framing this would only require an unprivileged user, so no elevated privilege is needed on any path.\nUI:N - No human action is required \u2014 the attacker forces state recovery, and the sillyrename/close side is satisfied by ordinary background filesystem activity already running on the client.\nS:U - The deadlock is confined to the NFS client kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - This is purely a lock/RPC-ordering deadlock with no memory corruption, out-of-bounds access, or uninitialized data exposure. No information is disclosed to the attacker.\nI:N - No attacker-controlled data modification occurs; nothing is written out of bounds and no state is corrupted in an attacker-directed way. The pending silly-delete simply never completes.\nA:H - The NFSv4 state manager kthread deadlocks permanently with the session slot table left in the draining state, so every subsequent NFSv4 RPC to that server blocks forever \u2014 all processes touching any mount from that nfs_client hang unkillably in D state, umount and clean shutdown wedge, and recovery requires a hard reboot. On NFS-root systems (diskless workstations, HPC nodes, thin clients, embedded controllers) this hangs the entire machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:15.442Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4fe4ae6c2e01d028856b73b6328b12b8945df871"
        },
        {
          "url": "https://git.kernel.org/stable/c/f41a60bc43e7abbc636fee78bed0d74c31e738b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f8df955f078e1a023ee55161935000a67651f38"
        }
      ],
      "title": "NFSv4: Fix a deadlock when recovering state on a sillyrenamed file",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21900",
    "datePublished": "2025-04-01T15:26:51.290Z",
    "dateReserved": "2024-12-29T08:45:45.783Z",
    "dateUpdated": "2026-08-05T11:55:15.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21900",
      "date": "2026-08-06",
      "epss": "0.00325",
      "percentile": "0.24935"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21900\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:20.440\",\"lastModified\":\"2026-07-30T06:21:56.153\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFSv4: Fix a deadlock when recovering state on a sillyrenamed file\\n\\nIf the file is sillyrenamed, and slated for delete on close, it is\\npossible for a server reboot to triggeer an open reclaim, with can again\\nrace with the application call to close(). When that happens, the call\\nto put_nfs_open_context() can trigger a synchronous delegreturn call\\nwhich deadlocks because it is not marked as privileged.\\n\\nInstead, ensure that the call to nfs4_inode_return_delegation_on_close()\\ncatches the delegreturn, and schedules it asynchronously.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFSv4: Se corrige un bloqueo al recuperar el estado de un archivo con un nombre sillyrenombrado. Si el archivo tiene un nombre sillyrenombrado y se programa para eliminarse al cerrarse, es posible que un reinicio del servidor active una recuperaci\u00f3n abierta, que puede competir con la llamada de la aplicaci\u00f3n a close(). En este caso, la llamada a put_nfs_open_context() puede activar una llamada delegreturn s\u00edncrona que se bloquea al no estar marcada como privilegiada. En su lugar, aseg\u00farese de que la llamada a nfs4_inode_return_delegation_on_close() capture la devoluci\u00f3n delegreturn y la programe de forma as\u00edncrona.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfs/delegation.c\",\"fs/nfs/delegation.h\",\"fs/nfs/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"adb4b42d19aea91826621a8d0bac94cf2c08f8bc\",\"lessThan\":\"4fe4ae6c2e01d028856b73b6328b12b8945df871\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"adb4b42d19aea91826621a8d0bac94cf2c08f8bc\",\"lessThan\":\"f41a60bc43e7abbc636fee78bed0d74c31e738b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"adb4b42d19aea91826621a8d0bac94cf2c08f8bc\",\"lessThan\":\"8f8df955f078e1a023ee55161935000a67651f38\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfs/delegation.c\",\"fs/nfs/delegation.h\",\"fs/nfs/nfs4proc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.18\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.6\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T17:18:02.848036Z\",\"id\":\"CVE-2025-21900\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.12.18\",\"matchCriteriaId\":\"F5B351D2-724D-4334-AC35-A9017217FE4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.6\",\"matchCriteriaId\":\"64F12D9B-71C2-4CD7-A288-0D5EF1709620\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4fe4ae6c2e01d028856b73b6328b12b8945df871\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8f8df955f078e1a023ee55161935000a67651f38\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f41a60bc43e7abbc636fee78bed0d74c31e738b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:38:08+00:00",
      "cve": "CVE-2025-21900",
      "id": "CVE-2025-21900",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:known_affected": "226",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFSv4: Fix a deadlock when recovering state on a sillyrenamed file",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21900.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-26T23:33:44Z",
      "cve": "CVE-2025-21900",
      "id": "CVE-2025-21900",
      "initial_release_date": "2025-04-02T13:29:29Z",
      "product_status:known_not_affected": "344",
      "product_status:recommended": "53",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21900",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21900.json",
      "version": "12"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21900\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T17:18:02.848036Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-667\", \"description\": \"CWE-667 Improper Locking\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T14:37:22.348Z\"}}], \"cna\": {\"title\": \"NFSv4: Fix a deadlock when recovering state on a sillyrenamed file\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - This is NFSv4 client code whose vulnerable path is entered only in response to remote server behaviour \\u2014 a server reboot/session reset (NFS4ERR_STALE_CLIENTID, NFS4ERR_BAD_SESSION, lease expiry) drives the state manager into open reclaim, and the blocking DELEGRETURN is an RPC to that server. A malicious or compromised NFS server, or an on-path attacker on a typical AUTH_SYS mount, can force state recovery at will over the network.\\nAC:L - This is not a tight instruction-level race: the state manager holds the open-context reference across a full OPEN reclaim round trip whose duration the server chooses, and it can be stretched further with NFS4ERR_DELAY/NFS4ERR_GRACE, so the attacker controls the window width and can force recovery repeatedly until the race lands. The other side \\u2014 an open, unlinked (sillyrenamed) file being closed \\u2014 is ubiquitous in normal workloads (tmpfile(), mkstemp+unlink, editors, build systems, mail spools).\\nPR:N - The attacker is the remote NFS server (or an on-path attacker) and needs no credentials or account on the victim client; the mount is a pre-existing deployment condition. Even under a purely local framing this would only require an unprivileged user, so no elevated privilege is needed on any path.\\nUI:N - No human action is required \\u2014 the attacker forces state recovery, and the sillyrename/close side is satisfied by ordinary background filesystem activity already running on the client.\\nS:U - The deadlock is confined to the NFS client kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:N - This is purely a lock/RPC-ordering deadlock with no memory corruption, out-of-bounds access, or uninitialized data exposure. No information is disclosed to the attacker.\\nI:N - No attacker-controlled data modification occurs; nothing is written out of bounds and no state is corrupted in an attacker-directed way. The pending silly-delete simply never completes.\\nA:H - The NFSv4 state manager kthread deadlocks permanently with the session slot table left in the draining state, so every subsequent NFSv4 RPC to that server blocks forever \\u2014 all processes touching any mount from that nfs_client hang unkillably in D state, umount and clean shutdown wedge, and recovery requires a hard reboot. On NFS-root systems (diskless workstations, HPC nodes, thin clients, embedded controllers) this hangs the entire machine.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"adb4b42d19aea91826621a8d0bac94cf2c08f8bc\", \"lessThan\": \"4fe4ae6c2e01d028856b73b6328b12b8945df871\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"adb4b42d19aea91826621a8d0bac94cf2c08f8bc\", \"lessThan\": \"f41a60bc43e7abbc636fee78bed0d74c31e738b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"adb4b42d19aea91826621a8d0bac94cf2c08f8bc\", \"lessThan\": \"8f8df955f078e1a023ee55161935000a67651f38\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/nfs/delegation.c\", \"fs/nfs/delegation.h\", \"fs/nfs/nfs4proc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.18\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/nfs/delegation.c\", \"fs/nfs/delegation.h\", \"fs/nfs/nfs4proc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4fe4ae6c2e01d028856b73b6328b12b8945df871\"}, {\"url\": \"https://git.kernel.org/stable/c/f41a60bc43e7abbc636fee78bed0d74c31e738b0\"}, {\"url\": \"https://git.kernel.org/stable/c/8f8df955f078e1a023ee55161935000a67651f38\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nNFSv4: Fix a deadlock when recovering state on a sillyrenamed file\\n\\nIf the file is sillyrenamed, and slated for delete on close, it is\\npossible for a server reboot to triggeer an open reclaim, with can again\\nrace with the application call to close(). When that happens, the call\\nto put_nfs_open_context() can trigger a synchronous delegreturn call\\nwhich deadlocks because it is not marked as privileged.\\n\\nInstead, ensure that the call to nfs4_inode_return_delegation_on_close()\\ncatches the delegreturn, and schedules it asynchronously.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.18\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.6\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:55:15.442Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21900\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:55:15.442Z\", \"dateReserved\": \"2024-12-29T08:45:45.783Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-04-01T15:26:51.290Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.