CVE-2025-38724

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The nfsd4 setclientid confirm() function did not check the return value from get client locked(). A SETCLIENTID CONFIRM operation could race with a confirmed client expiring, failing to obtain a reference, and potentially leading to a use-after-free (UAF) condition. The issue was addressed by obtaining a reference early in the case of an existing confirmed client and handling failures appropriately.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.