Published: 27/02/2025 Updated: 21/03/2025

Linux Kernel NFSD Use-After-Free Vulnerability in ACL Handling

A Linux kernel vulnerability in the Network File System Daemon (nfsd) has been resolved involving a use-after-free (UAF) issue. When attempting to get acl_default, if the process fails, acl_access and acl_default are released simultaneously. However, acl_access retains a pointer to the already released posix_acl, which can trigger a warning about reference count underflow. This can potentially lead to a kernel panic due to the use-after-free condition. The fix involves clearing acl_access and acl_default after calling posix_acl_release to prevent the UAF vulnerability from being triggered, thereby ensuring proper memory management and preventing potential system instability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux
linux linux kernel
linux linux kernel 6.14

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when attempting to join an aborted transaction (CVE-2025-21753) In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796) ...

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982) In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfq_limit_depth() (CVE-2024-53166) In the Linux kernel, the following vulnerability has been resolved: ...

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them (CVE-2025-21796) ...

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free of encap entry in neigh update handler (CVE-2021-47247) In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress (CVE-2023-52975) In the Linux kernel, the following vu ...

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential oob read in nilfs_btree_check_delete() (CVE-2024-47757) In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path (CVE-2024-49882) In the Linux kernel, the following vulnerability has been reso ...

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982) In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS (CVE-2024-46830) In the Linux kernel, the following vulnerability ...

In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for real_dev (CVE-2022-49390) In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982) In the Linux kernel, the following vulnerability has been resolved: smb: client: ...

Critical Infrastructure Sectors: Energy

CWE-416 https://nvd.nist.gov https://alas.aws.amazon.com/AL2023/ALASLIVEPATCH-2025-042.html https://www.first.org/epss https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05 https://git.kernel.org/stable/c/1fd94884174bd20beb1773990fd3b1aa877688d9 https://git.kernel.org/stable/c/2e59b2b68782519560b3d6a41dd66a3d01a01cd3 https://git.kernel.org/stable/c/55d947315fb5f67a35e4e1d3e01bb886b9c6decf https://git.kernel.org/stable/c/6f7cfee1a316891890c505563aa54f3476db52fd https://git.kernel.org/stable/c/7faf14a7b0366f153284db0ad3347c457ea70136 https://git.kernel.org/stable/c/8a1737ae42c928384ab6447f6ee1a882510e85fa https://git.kernel.org/stable/c/f8d871523142f7895f250a856f8c4a4181614510

CVE-2025-21796

Vulnerability Summary

Vendor Advisories

ICS Advisories

References

Vulmon Search

About

Products

Connect