CVE-2025-21796

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6

Description A use-after-free issue exists in the Linux kernel. When posix acl release is called, acl access and acl default are released simultaneously. However, acl access retains a pointer to the released posix acl, triggering a warning in nfs3svc release getacl. This can lead to a kernel panic.

Recommendations For Linux kernel versions prior to 6.12.0-rc6, clear acl access and acl default after posix acl release is called to prevent the use-after-free issue. As a temporary workaround, consider disabling the nfsd service until a patch is available.