{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21900",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:18:02.848036Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-667",
                "description": "CWE-667 Improper Locking",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:18:05.662Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/delegation.c",
            "fs/nfs/delegation.h",
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4fe4ae6c2e01d028856b73b6328b12b8945df871",
              "status": "affected",
              "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc",
              "versionType": "git"
            },
            {
              "lessThan": "f41a60bc43e7abbc636fee78bed0d74c31e738b0",
              "status": "affected",
              "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc",
              "versionType": "git"
            },
            {
              "lessThan": "8f8df955f078e1a023ee55161935000a67651f38",
              "status": "affected",
              "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/delegation.c",
            "fs/nfs/delegation.h",
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.18",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix a deadlock when recovering state on a sillyrenamed file\n\nIf the file is sillyrenamed, and slated for delete on close, it is\npossible for a server reboot to triggeer an open reclaim, with can again\nrace with the application call to close(). When that happens, the call\nto put_nfs_open_context() can trigger a synchronous delegreturn call\nwhich deadlocks because it is not marked as privileged.\n\nInstead, ensure that the call to nfs4_inode_return_delegation_on_close()\ncatches the delegreturn, and schedules it asynchronously."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - This is NFSv4 client code whose vulnerable path is entered only in response to remote server behaviour \u2014 a server reboot/session reset (NFS4ERR_STALE_CLIENTID, NFS4ERR_BAD_SESSION, lease expiry) drives the state manager into open reclaim, and the blocking DELEGRETURN is an RPC to that server. A malicious or compromised NFS server, or an on-path attacker on a typical AUTH_SYS mount, can force state recovery at will over the network.\nAC:L - This is not a tight instruction-level race: the state manager holds the open-context reference across a full OPEN reclaim round trip whose duration the server chooses, and it can be stretched further with NFS4ERR_DELAY/NFS4ERR_GRACE, so the attacker controls the window width and can force recovery repeatedly until the race lands. The other side \u2014 an open, unlinked (sillyrenamed) file being closed \u2014 is ubiquitous in normal workloads (tmpfile(), mkstemp+unlink, editors, build systems, mail spools).\nPR:N - The attacker is the remote NFS server (or an on-path attacker) and needs no credentials or account on the victim client; the mount is a pre-existing deployment condition. Even under a purely local framing this would only require an unprivileged user, so no elevated privilege is needed on any path.\nUI:N - No human action is required \u2014 the attacker forces state recovery, and the sillyrename/close side is satisfied by ordinary background filesystem activity already running on the client.\nS:U - The deadlock is confined to the NFS client kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - This is purely a lock/RPC-ordering deadlock with no memory corruption, out-of-bounds access, or uninitialized data exposure. No information is disclosed to the attacker.\nI:N - No attacker-controlled data modification occurs; nothing is written out of bounds and no state is corrupted in an attacker-directed way. The pending silly-delete simply never completes.\nA:H - The NFSv4 state manager kthread deadlocks permanently with the session slot table left in the draining state, so every subsequent NFSv4 RPC to that server blocks forever \u2014 all processes touching any mount from that nfs_client hang unkillably in D state, umount and clean shutdown wedge, and recovery requires a hard reboot. On NFS-root systems (diskless workstations, HPC nodes, thin clients, embedded controllers) this hangs the entire machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:15.442Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4fe4ae6c2e01d028856b73b6328b12b8945df871"
        },
        {
          "url": "https://git.kernel.org/stable/c/f41a60bc43e7abbc636fee78bed0d74c31e738b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f8df955f078e1a023ee55161935000a67651f38"
        }
      ],
      "title": "NFSv4: Fix a deadlock when recovering state on a sillyrenamed file",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21900",
    "datePublished": "2025-04-01T15:26:51.290Z",
    "dateReserved": "2024-12-29T08:45:45.783Z",
    "dateUpdated": "2026-08-05T11:55:15.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}