GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-37871 (GCVE-0-2025-37871)

Vulnerability from cvelistv5 – Published: 2025-05-09 06:43 – Updated: 2026-08-05 11:57
VLAI
Title
nfsd: decrease sc_count directly if fail to queue dl_recall
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sc_count directly if fail to queue dl_recall A deadlock warning occurred when invoking nfs4_put_stid following a failed dl_recall queue operation: T1 T2 nfs4_laundromat nfs4_get_client_reaplist nfs4_anylock_blockers __break_lease spin_lock // ctx->flc_lock spin_lock // clp->cl_lock nfs4_lockowner_has_blockers locks_owner_has_blockers spin_lock // flctx->flc_lock nfsd_break_deleg_cb nfsd_break_one_deleg nfs4_put_stid refcount_dec_and_lock spin_lock // clp->cl_lock When a file is opened, an nfs4_delegation is allocated with sc_count initialized to 1, and the file_lease holds a reference to the delegation. The file_lease is then associated with the file through kernel_setlease. The disassociation is performed in nfsd4_delegreturn via the following call chain: nfsd4_delegreturn --> destroy_delegation --> destroy_unhashed_deleg --> nfs4_unlock_deleg_lease --> kernel_setlease --> generic_delete_lease The corresponding sc_count reference will be released after this disassociation. Since nfsd_break_one_deleg executes while holding the flc_lock, the disassociation process becomes blocked when attempting to acquire flc_lock in generic_delete_lease. This means: 1) sc_count in nfsd_break_one_deleg will not be decremented to 0; 2) The nfs4_put_stid called by nfsd_break_one_deleg will not attempt to acquire cl_lock; 3) Consequently, no deadlock condition is created. Given that sc_count in nfsd_break_one_deleg remains non-zero, we can safely perform refcount_dec on sc_count directly. This approach effectively avoids triggering deadlock warnings.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b874cdef4e67e5150e07eff0eae1cbb21fb92da1 , < b9bbe8f9d5663311d06667ce36d6ed255ead1a26 (git)
Affected: cdb796137c57e68ca34518d53be53b679351eb86 , < a70832d3555987035fc430ccd703acd89393eadb (git)
Affected: d96587cc93ec369031bcd7658c6adc719873c9fd , < ba903539fff745d592d893c71b30e5e268a95413 (git)
Affected: 9a81cde8c7ce65dd90fb47ceea93a45fc1a2fbd1 , < 7d192e27a431026c58d60edf66dc6cd98d0c01fc (git)
Affected: cad3479b63661a399c9df1d0b759e1806e2df3c8 , < a7fce086f6ca84db409b9d58493ea77c1978897c (git)
Affected: 133f5e2a37ce08c82d24e8fba65e0a81deae4609 , < 14985d66b9b99c12995dd99d1c6c8dec4114c2a5 (git)
Affected: 230ca758453c63bd38e4d9f4a21db698f7abada8 , < a1d14d931bf700c1025db8c46d6731aa5cf440f9 (git)
Affected: 63b91c8ff4589f5263873b24c052447a28e10ef7 (git)
Affected: 6.13.11 , < 6.14 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.10.236 , < 5.10.237 (semver)
Affected: 5.15.180 , < 5.15.181 (semver)
Affected: 6.1.134 , < 6.1.135 (semver)
Affected: 6.6.87 , < 6.6.88 (semver)
Affected: 6.12.23 , < 6.12.25 (semver)
Affected: 6.14.2 , < 6.14.4 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:56:48.360Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b9bbe8f9d5663311d06667ce36d6ed255ead1a26",
              "status": "affected",
              "version": "b874cdef4e67e5150e07eff0eae1cbb21fb92da1",
              "versionType": "git"
            },
            {
              "lessThan": "a70832d3555987035fc430ccd703acd89393eadb",
              "status": "affected",
              "version": "cdb796137c57e68ca34518d53be53b679351eb86",
              "versionType": "git"
            },
            {
              "lessThan": "ba903539fff745d592d893c71b30e5e268a95413",
              "status": "affected",
              "version": "d96587cc93ec369031bcd7658c6adc719873c9fd",
              "versionType": "git"
            },
            {
              "lessThan": "7d192e27a431026c58d60edf66dc6cd98d0c01fc",
              "status": "affected",
              "version": "9a81cde8c7ce65dd90fb47ceea93a45fc1a2fbd1",
              "versionType": "git"
            },
            {
              "lessThan": "a7fce086f6ca84db409b9d58493ea77c1978897c",
              "status": "affected",
              "version": "cad3479b63661a399c9df1d0b759e1806e2df3c8",
              "versionType": "git"
            },
            {
              "lessThan": "14985d66b9b99c12995dd99d1c6c8dec4114c2a5",
              "status": "affected",
              "version": "133f5e2a37ce08c82d24e8fba65e0a81deae4609",
              "versionType": "git"
            },
            {
              "lessThan": "a1d14d931bf700c1025db8c46d6731aa5cf440f9",
              "status": "affected",
              "version": "230ca758453c63bd38e4d9f4a21db698f7abada8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "63b91c8ff4589f5263873b24c052447a28e10ef7",
              "versionType": "git"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.10.237",
              "status": "affected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.181",
              "status": "affected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.135",
              "status": "affected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.88",
              "status": "affected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.25",
              "status": "affected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14.4",
              "status": "affected",
              "version": "6.14.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.237",
                  "versionStartIncluding": "5.10.236",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "5.15.180",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.135",
                  "versionStartIncluding": "6.1.134",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.88",
                  "versionStartIncluding": "6.6.87",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.25",
                  "versionStartIncluding": "6.12.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.4",
                  "versionStartIncluding": "6.14.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: decrease sc_count directly if fail to queue dl_recall\n\nA deadlock warning occurred when invoking nfs4_put_stid following a failed\ndl_recall queue operation:\n            T1                            T2\n                                nfs4_laundromat\n                                 nfs4_get_client_reaplist\n                                  nfs4_anylock_blockers\n__break_lease\n spin_lock // ctx-\u003eflc_lock\n                                   spin_lock // clp-\u003ecl_lock\n                                   nfs4_lockowner_has_blockers\n                                    locks_owner_has_blockers\n                                     spin_lock // flctx-\u003eflc_lock\n nfsd_break_deleg_cb\n  nfsd_break_one_deleg\n   nfs4_put_stid\n    refcount_dec_and_lock\n     spin_lock // clp-\u003ecl_lock\n\nWhen a file is opened, an nfs4_delegation is allocated with sc_count\ninitialized to 1, and the file_lease holds a reference to the delegation.\nThe file_lease is then associated with the file through kernel_setlease.\n\nThe disassociation is performed in nfsd4_delegreturn via the following\ncall chain:\nnfsd4_delegreturn --\u003e destroy_delegation --\u003e destroy_unhashed_deleg --\u003e\nnfs4_unlock_deleg_lease --\u003e kernel_setlease --\u003e generic_delete_lease\nThe corresponding sc_count reference will be released after this\ndisassociation.\n\nSince nfsd_break_one_deleg executes while holding the flc_lock, the\ndisassociation process becomes blocked when attempting to acquire flc_lock\nin generic_delete_lease. This means:\n1) sc_count in nfsd_break_one_deleg will not be decremented to 0;\n2) The nfs4_put_stid called by nfsd_break_one_deleg will not attempt to\nacquire cl_lock;\n3) Consequently, no deadlock condition is created.\n\nGiven that sc_count in nfsd_break_one_deleg remains non-zero, we can\nsafely perform refcount_dec on sc_count directly. This approach\neffectively avoids triggering deadlock warnings."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the in-kernel NFS server\u0027s delegation-recall path (fs/nfsd/nfs4state.c, nfsd_break_one_deleg), which is driven entirely by remote NFSv4 protocol operations \u2014 a remote client obtains a delegation via OPEN, and a second remote client\u0027s conflicting OPEN drives __break_lease() into nfsd_break_deleg_cb(). No local access to the server is required.\nAC:L - The attacker reaches the faulty !queued branch at will: __break_lease() only sets FL_UNLOCK_PENDING for write-breaks, so a read-conflicting OPEN followed immediately by a write-conflicting OPEN calls lm_break() twice on the same lease, and the second nfsd4_run_cb() finds cb_work still pending so queue_work() returns false. Both sides are attacker-driven and the sequence can be retried indefinitely; the affected stable branches have no NFSD4_CALLBACK_RUNNING guard at all.\nPR:N - Reaching the code only requires being an NFSv4 client of an export; with the default AUTH_SYS flavor no real authentication or server-side credential is verified, so an unauthenticated host that can reach TCP/2049 can obtain a delegation and trigger the conflicting-open recall.\nUI:N - The recall, the failed callback queueing and the concurrent nfs4_laundromat scan all happen autonomously in the server; no administrator or user action on the victim is needed.\nS:U - The faulty locking and its consequences are confined to the nfsd/VFS lease code within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is purely a lock-ordering/refcount-release issue; no attacker-readable memory is disclosed and nothing is returned to the client on this path.\nI:N - No memory corruption, out-of-bounds write, or state modification occurs \u2014 the reference count ends at the same value either way, so no integrity primitive is created.\nA:H - Calling nfs4_put_stid() under ctx-\u003eflc_lock introduces an flc_lock -\u003e cl_lock ordering (via might_lock() and refcount_dec_and_lock()) that inverts the cl_lock -\u003e flc_lock order taken by nfs4_laundromat()/nfs4_anylock_blockers(), producing a circular-locking-dependency report that taints the kernel, permanently disables lock validation, and aborts the machine on panic_on_warn configurations; should the delegation\u0027s lease reference ever not be held, the same path is a hard spinlock ABBA deadlock that hangs the NFS server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:57:57.052Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b9bbe8f9d5663311d06667ce36d6ed255ead1a26"
        },
        {
          "url": "https://git.kernel.org/stable/c/a70832d3555987035fc430ccd703acd89393eadb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba903539fff745d592d893c71b30e5e268a95413"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d192e27a431026c58d60edf66dc6cd98d0c01fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7fce086f6ca84db409b9d58493ea77c1978897c"
        },
        {
          "url": "https://git.kernel.org/stable/c/14985d66b9b99c12995dd99d1c6c8dec4114c2a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1d14d931bf700c1025db8c46d6731aa5cf440f9"
        }
      ],
      "title": "nfsd: decrease sc_count directly if fail to queue dl_recall",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37871",
    "datePublished": "2025-05-09T06:43:59.720Z",
    "dateReserved": "2025-04-16T04:51:23.959Z",
    "dateUpdated": "2026-08-05T11:57:57.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37871",
      "date": "2026-09-16",
      "epss": "0.00735",
      "percentile": "0.52709"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37871\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-09T07:16:08.210\",\"lastModified\":\"2026-07-30T06:22:24.690\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: decrease sc_count directly if fail to queue dl_recall\\n\\nA deadlock warning occurred when invoking nfs4_put_stid following a failed\\ndl_recall queue operation:\\n            T1                            T2\\n                                nfs4_laundromat\\n                                 nfs4_get_client_reaplist\\n                                  nfs4_anylock_blockers\\n__break_lease\\n spin_lock // ctx-\u003eflc_lock\\n                                   spin_lock // clp-\u003ecl_lock\\n                                   nfs4_lockowner_has_blockers\\n                                    locks_owner_has_blockers\\n                                     spin_lock // flctx-\u003eflc_lock\\n nfsd_break_deleg_cb\\n  nfsd_break_one_deleg\\n   nfs4_put_stid\\n    refcount_dec_and_lock\\n     spin_lock // clp-\u003ecl_lock\\n\\nWhen a file is opened, an nfs4_delegation is allocated with sc_count\\ninitialized to 1, and the file_lease holds a reference to the delegation.\\nThe file_lease is then associated with the file through kernel_setlease.\\n\\nThe disassociation is performed in nfsd4_delegreturn via the following\\ncall chain:\\nnfsd4_delegreturn --\u003e destroy_delegation --\u003e destroy_unhashed_deleg --\u003e\\nnfs4_unlock_deleg_lease --\u003e kernel_setlease --\u003e generic_delete_lease\\nThe corresponding sc_count reference will be released after this\\ndisassociation.\\n\\nSince nfsd_break_one_deleg executes while holding the flc_lock, the\\ndisassociation process becomes blocked when attempting to acquire flc_lock\\nin generic_delete_lease. This means:\\n1) sc_count in nfsd_break_one_deleg will not be decremented to 0;\\n2) The nfs4_put_stid called by nfsd_break_one_deleg will not attempt to\\nacquire cl_lock;\\n3) Consequently, no deadlock condition is created.\\n\\nGiven that sc_count in nfsd_break_one_deleg remains non-zero, we can\\nsafely perform refcount_dec on sc_count directly. This approach\\neffectively avoids triggering deadlock warnings.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfsd: disminuir sc_count directamente si no se puede poner en cola dl_recall Se produjo una advertencia de bloqueo al invocar nfs4_put_stid despu\u00e9s de una operaci\u00f3n de cola dl_recall fallida: T1 T2 nfs4_laundromat nfs4_get_client_reaplist nfs4_anylock_blockers __break_lease spin_lock // ctx-\u0026gt;flc_lock spin_lock // clp-\u0026gt;cl_lock nfs4_lockowner_has_blockers locks_owner_has_blockers spin_lock // flctx-\u0026gt;flc_lock nfsd_break_deleg_cb nfsd_break_one_deleg nfs4_put_stid refcount_dec_and_lock spin_lock // clp-\u0026gt;cl_lock Cuando se abre un archivo, se genera una nfs4_delegation asignado con sc_count inicializado a 1, y el file_lease contiene una referencia a la delegaci\u00f3n. El file_lease se asocia entonces con el archivo a trav\u00e9s de kernel_setlease. La disociaci\u00f3n se realiza en nfsd4_delegreturn mediante la siguiente cadena de llamadas: nfsd4_delegreturn --\u0026gt; destroy_delegation --\u0026gt; destroy_unhashed_deleg --\u0026gt; nfs4_unlock_deleg_lease --\u0026gt; kernel_setlease --\u0026gt; generic_delete_lease La referencia sc_count correspondiente se liberar\u00e1 despu\u00e9s de esta disociaci\u00f3n. Dado que nfsd_break_one_deleg se ejecuta mientras mantiene el flc_lock, el proceso de disociaci\u00f3n se bloquea al intentar adquirir flc_lock en generic_delete_lease. Esto significa: 1) sc_count en nfsd_break_one_deleg no se decrementar\u00e1 a 0; 2) El `nfs4_put_stid` llamado por `nfsd_break_one_deleg` no intentar\u00e1 adquirir `cl_lock`; 3) Por consiguiente, no se crea ninguna condici\u00f3n de interbloqueo. Dado que `sc_count` en `nfsd_break_one_deleg` permanece distinto de cero, podemos ejecutar `refcount_dec` en `sc_count` directamente. Este enfoque evita eficazmente la activaci\u00f3n de advertencias de interbloqueo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b874cdef4e67e5150e07eff0eae1cbb21fb92da1\",\"lessThan\":\"b9bbe8f9d5663311d06667ce36d6ed255ead1a26\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdb796137c57e68ca34518d53be53b679351eb86\",\"lessThan\":\"a70832d3555987035fc430ccd703acd89393eadb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d96587cc93ec369031bcd7658c6adc719873c9fd\",\"lessThan\":\"ba903539fff745d592d893c71b30e5e268a95413\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a81cde8c7ce65dd90fb47ceea93a45fc1a2fbd1\",\"lessThan\":\"7d192e27a431026c58d60edf66dc6cd98d0c01fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cad3479b63661a399c9df1d0b759e1806e2df3c8\",\"lessThan\":\"a7fce086f6ca84db409b9d58493ea77c1978897c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"133f5e2a37ce08c82d24e8fba65e0a81deae4609\",\"lessThan\":\"14985d66b9b99c12995dd99d1c6c8dec4114c2a5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"230ca758453c63bd38e4d9f4a21db698f7abada8\",\"lessThan\":\"a1d14d931bf700c1025db8c46d6731aa5cf440f9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"63b91c8ff4589f5263873b24c052447a28e10ef7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.13.11\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10.236\",\"lessThan\":\"5.10.237\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.180\",\"lessThan\":\"5.15.181\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.134\",\"lessThan\":\"6.1.135\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.87\",\"lessThan\":\"6.6.88\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.23\",\"lessThan\":\"6.12.25\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.14.2\",\"lessThan\":\"6.14.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12.23\",\"versionEndExcluding\":\"6.12.25\",\"matchCriteriaId\":\"FC39818A-8C20-4C6C-8155-9E364AC53D54\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13.11\",\"versionEndExcluding\":\"6.14\",\"matchCriteriaId\":\"124AE182-7E9F-4410-9E08-5976ED49C6A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14.2\",\"versionEndExcluding\":\"6.14.4\",\"matchCriteriaId\":\"ABA7F402-1511-4ECC-907D-578BA5B25742\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.10.236:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9160FCF1-2EF7-4794-86E9-26699C94A1FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.15.180:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5BC2D57B-41D0-407A-94E2-C73578390691\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.1.134:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5712D157-5E0C-40C1-97C5-7256A0103FC7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.6.87:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5321373-E31B-44C8-84D5-0AC97FF10114\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/14985d66b9b99c12995dd99d1c6c8dec4114c2a5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d192e27a431026c58d60edf66dc6cd98d0c01fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a1d14d931bf700c1025db8c46d6731aa5cf440f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a70832d3555987035fc430ccd703acd89393eadb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a7fce086f6ca84db409b9d58493ea77c1978897c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b9bbe8f9d5663311d06667ce36d6ed255ead1a26\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ba903539fff745d592d893c71b30e5e268a95413\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-03T07:16:21+00:00",
      "cve": "CVE-2025-37871",
      "id": "CVE-2025-37871",
      "initial_release_date": "2025-05-09T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "232",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: decrease sc_count directly if fail to queue dl_recall",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37871.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T01:58:49Z",
      "cve": "CVE-2025-37871",
      "id": "CVE-2025-37871",
      "initial_release_date": "2025-05-10T02:52:35Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "371",
      "product_status:recommended": "433",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37871",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37871.json",
      "version": "44"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.