Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d20c11d86d8f821a64eac7d6c8f296f06d935f4f to < 3f252a73e81aa01660cb426735eab932e6182e8daffectedd20c11d86d8f821a64eac7d6c8f296f06d935f4f to < d35ac850410966010e92f401f4e21868a9ea4d8baffectedd20c11d86d8f821a64eac7d6c8f296f06d935f4f to < f3aac6cf390d8b80e1d82975faf4ac61175519c0affectedd20c11d86d8f821a64eac7d6c8f296f06d935f4f to < 22f45cedf281e6171817c8a3432c44d788c550e1affectedd20c11d86d8f821a64eac7d6c8f296f06d935f4f to < d71abd1ae4e0413707cd42b10c24a11d1aa71772affectedd20c11d86d8f821a64eac7d6c8f296f06d935f4f to < 74ad36ed60df561a303a19ecef400c7096b20306affectedd20c11d86d8f821a64eac7d6c8f296f06d935f4f to < 36e83eda90e0e4ac52f259f775b40b2841f8a0a3affectedd20c11d86d8f821a64eac7d6c8f296f06d935f4f to < 571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1affectedd20c11d86d8f821a64eac7d6c8f296f06d935f4f to < 908e4ead7f757504d8b345452730636e298cbf68affected
Linux Linux
Default version status: affected
3.17affected0 to < 3.17unaffected5.4.297 to ≤ 5.4.*unaffected5.10.241 to ≤ 5.10.*unaffected5.15.190 to ≤ 5.15.*unaffected6.1.149 to ≤ 6.1.*unaffected6.6.103 to ≤ 6.6.*unaffected6.12.43 to ≤ 6.12.*unaffected6.15.11 to ≤ 6.15.*unaffected6.16.2 to ≤ 6.16.*unaffected6.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8d ↗
- https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8b ↗
- https://git.kernel.org/stable/c/f3aac6cf390d8b80e1d82975faf4ac61175519c0 ↗
- https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1 ↗
- https://git.kernel.org/stable/c/d71abd1ae4e0413707cd42b10c24a11d1aa71772 ↗
- https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306 ↗
- https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3 ↗
- https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1 ↗
- https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68 ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html ↗
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html ↗