{"id":"CVE-2025-21795","state":"PUBLISHED","title":"NFSD: fix hang in nfsd4_shutdown_callback","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix hang in nfsd4_shutdown_callback\n\nIf nfs4_client is in courtesy state then there is no point to send\nthe callback. This causes nfsd4_shutdown_callback to hang since\ncl_cb_inflight is not 0. This hang lasts about 15 minutes until TCP\nnotifies NFSD that the connection was dropped.\n\nThis patch modifies nfsd4_run_cb_work to skip the RPC call if\nnfs4_client is in courtesy state.","publishedAt":"2025-02-27T02:18:31.538Z","updatedAt":"2026-10-15T01:04:27.946Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"67ef9e5fd737eab2495f2586df7e9ea30caa1b77","status":"affected","lessThan":"abed68027ea3ab893ac85cc46a00e2e64a324239","versionType":"git"},{"version":"26540b8940a2e21582afa61a6fb8af87310bac72","status":"affected","lessThan":"efa8a261c575f816c7e79a87aeb3ef8a0bd6b221","versionType":"git"},{"version":"66af25799940b26efd41ea6e648f75c41a48a2c2","status":"affected","lessThan":"38d345f612503b850c2973e5a879f88e441b34d7","versionType":"git"},{"version":"66af25799940b26efd41ea6e648f75c41a48a2c2","status":"affected","lessThan":"23ad7797c74cd8f7f90617f1e59a8703e2b43908","versionType":"git"},{"version":"66af25799940b26efd41ea6e648f75c41a48a2c2","status":"affected","lessThan":"cedfbb92cf97a6bff3d25633001d9c44442ee854","versionType":"git"},{"version":"66af25799940b26efd41ea6e648f75c41a48a2c2","status":"affected","lessThan":"e88d2451cd42e025465d6b51fd716a47b0b3800d","versionType":"git"},{"version":"66af25799940b26efd41ea6e648f75c41a48a2c2","status":"affected","lessThan":"036ac2778f7b28885814c6fbc07e156ad1624d03","versionType":"git"},{"version":"5.10.220","status":"affected","lessThan":"5.10.235","versionType":"semver"},{"version":"5.15.154","status":"affected","lessThan":"5.15.179","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs4callback.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"5.10.235","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.179","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.79","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.16","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.4","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs4callback.c"]}],"references":["https://git.kernel.org/stable/c/abed68027ea3ab893ac85cc46a00e2e64a324239","https://git.kernel.org/stable/c/efa8a261c575f816c7e79a87aeb3ef8a0bd6b221","https://git.kernel.org/stable/c/38d345f612503b850c2973e5a879f88e441b34d7","https://git.kernel.org/stable/c/23ad7797c74cd8f7f90617f1e59a8703e2b43908","https://git.kernel.org/stable/c/cedfbb92cf97a6bff3d25633001d9c44442ee854","https://git.kernel.org/stable/c/e88d2451cd42e025465d6b51fd716a47b0b3800d","https://git.kernel.org/stable/c/036ac2778f7b28885814c6fbc07e156ad1624d03","https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://cert-portal.siemens.com/productcert/html/ssa-784472.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:39.238Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/21xxx/CVE-2025-21795.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-21795","state":"PUBLISHED","datePublished":"2025-02-27T02:18:31.538Z","dateUpdated":"2026-10-15T01:04:27.946Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-29T08:45:45.767Z"},"containers":{"cna":{"title":"NFSD: fix hang in nfsd4_shutdown_callback","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: fix hang in nfsd4_shutdown_callback\n\nIf nfs4_client is in courtesy state then there is no point to send\nthe callback. This causes nfsd4_shutdown_callback to hang since\ncl_cb_inflight is not 0. This hang lasts about 15 minutes until TCP\nnotifies NFSD that the connection was dropped.\n\nThis patch modifies nfsd4_run_cb_work to skip the RPC call if\nnfs4_client is in courtesy state."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"67ef9e5fd737eab2495f2586df7e9ea30caa1b77","status":"affected","lessThan":"abed68027ea3ab893ac85cc46a00e2e64a324239","versionType":"git"},{"version":"26540b8940a2e21582afa61a6fb8af87310bac72","status":"affected","lessThan":"efa8a261c575f816c7e79a87aeb3ef8a0bd6b221","versionType":"git"},{"version":"66af25799940b26efd41ea6e648f75c41a48a2c2","status":"affected","lessThan":"38d345f612503b850c2973e5a879f88e441b34d7","versionType":"git"},{"version":"66af25799940b26efd41ea6e648f75c41a48a2c2","status":"affected","lessThan":"23ad7797c74cd8f7f90617f1e59a8703e2b43908","versionType":"git"},{"version":"66af25799940b26efd41ea6e648f75c41a48a2c2","status":"affected","lessThan":"cedfbb92cf97a6bff3d25633001d9c44442ee854","versionType":"git"},{"version":"66af25799940b26efd41ea6e648f75c41a48a2c2","status":"affected","lessThan":"e88d2451cd42e025465d6b51fd716a47b0b3800d","versionType":"git"},{"version":"66af25799940b26efd41ea6e648f75c41a48a2c2","status":"affected","lessThan":"036ac2778f7b28885814c6fbc07e156ad1624d03","versionType":"git"},{"version":"5.10.220","status":"affected","lessThan":"5.10.235","versionType":"semver"},{"version":"5.15.154","status":"affected","lessThan":"5.15.179","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs4callback.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.19","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.19","versionType":"semver"},{"version":"5.10.235","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.179","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.79","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.16","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.4","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/nfs4callback.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/abed68027ea3ab893ac85cc46a00e2e64a324239"},{"url":"https://git.kernel.org/stable/c/efa8a261c575f816c7e79a87aeb3ef8a0bd6b221"},{"url":"https://git.kernel.org/stable/c/38d345f612503b850c2973e5a879f88e441b34d7"},{"url":"https://git.kernel.org/stable/c/23ad7797c74cd8f7f90617f1e59a8703e2b43908"},{"url":"https://git.kernel.org/stable/c/cedfbb92cf97a6bff3d25633001d9c44442ee854"},{"url":"https://git.kernel.org/stable/c/e88d2451cd42e025465d6b51fd716a47b0b3800d"},{"url":"https://git.kernel.org/stable/c/036ac2778f7b28885814c6fbc07e156ad1624d03"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is in the in-kernel NFS server (nfsd) and is reached entirely through NFSv4 protocol operations (OPEN/delegation, LOCK) from a remote network client over the wire.\nAC:L - The attacker controls both sides — obtaining a delegation then dropping its connection to become a courtesy client, and issuing the conflicting operation that forces the recall — and the recall itself deterministically triggers the expiry that hangs on the in-flight SOFTCONN RPC, so the ~15-minute hang is reliably reproducible.\nPR:N - NFS exports commonly use AUTH_SYS (no real authentication) and may be accessible to a subnet or anonymously, so an unauthenticated network client can perform the OPEN/delegation and conflicting-lock operations needed; no verified privilege is required.\nUI:N - The attacker's own NFS operations set up and trigger the hang; no action by any legitimate user or administrator is needed.\nS:U - The hang is confined to the NFS server's own kernel context and workqueues; it does not cross a security/authority boundary such as a VM or IOMMU boundary.\nC:N - The defect is a wait/hang on an in-flight callback with no memory disclosure or out-of-bounds read; no confidential information is exposed.\nI:N - No data is modified or corrupted; the bug only stalls the callback-shutdown path and involves no write primitive or state alteration.\nA:H - `nfsd4_shutdown_callback` hangs for ~15 minutes, blocking the laundromat workqueue (all lease/state/delegation/lock cleanup) and lock-conflict resolution that flushes the same queue, and the stall can be triggered repeatedly — a severe denial of service of the NFS server."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:54:30.327Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.220","versionEndExcluding":"5.10.235"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.154","versionEndExcluding":"5.15.179"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.1.129"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.6.79"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.12.16"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.13.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.19","versionEndExcluding":"6.14"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:59:38.867Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:04:27.946Z"},"x_adpType":"supplier"}]}}}