cbcvebase.
CVE-2025-37871
published 2025-05-09

CVE-2025-37871: In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sc_count directly if fail to queue dl_recall A deadlock warning occurred…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.71%
49.9th percentile
In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sc_count directly if fail to queue dl_recall A deadlock warning occurred when invoking nfs4_put_stid following a failed dl_recall queue operation: T1 T2 nfs4_laundromat nfs4_get_client_reaplist nfs4_anylock_blockers __break_lease spin_lock // ctx->flc_lock spin_lock // clp->cl_lock nfs4_lockowner_has_blockers locks_owner_has_blockers spin_lock // flctx->flc_lock nfsd_break_deleg_cb nfsd_break_one_deleg nfs4_put_stid refcount_dec_and_lock spin_lock // clp->cl_lock When a file is opened, an nfs4_delegation is allocated with sc_count initialized to 1, and the file_lease holds a reference to the delegation. The file_lease is then associated with the file through kernel_setlease. The disassociation is performed in nfsd4_delegreturn via the following call chain: nfsd4_delegreturn --> destroy_delegation --> destroy_unhashed_deleg --> nfs4_unlock_deleg_lease --> kernel_setlease --> generic_delete_lease The corresponding sc_count reference will be released after this disassociation. Since nfsd_break_one_deleg executes while holding the flc_lock, the disassociation process becomes blocked when attempting to acquire flc_lock in generic_delete_lease. This means: 1) sc_count in nfsd_break_one_deleg will not be decremented to 0; 2) The nfs4_put_stid called by nfsd_break_one_deleg will not attempt to acquire cl_lock; 3) Consequently, no deadlock condition is created. Given that sc_count in nfsd_break_one_deleg remains non-zero, we can safely perform refcount_dec on sc_count directly. This approach effectively avoids triggering deadlock warnings.

Affected

42 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.135-1 (bookworm)linux 6.1.135-1 (bookworm)
debianlinux-6.1< linux 6.1.135-1 (bookworm)linux 6.1.135-1 (bookworm)
linuxlinux
linuxlinux>= 133f5e2a37ce08c82d24e8fba65e0a81deae4609 < 14985d66b9b99c12995dd99d1c6c8dec4114c2a514985d66b9b99c12995dd99d1c6c8dec4114c2a5
linuxlinux>= 230ca758453c63bd38e4d9f4a21db698f7abada8 < a1d14d931bf700c1025db8c46d6731aa5cf440f9a1d14d931bf700c1025db8c46d6731aa5cf440f9
linuxlinux>= 5.10.236 < 5.10.2375.10.237
linuxlinux>= 5.15.180 < 5.15.1815.15.181
linuxlinux>= 6.1.134 < 6.1.1356.1.135
linuxlinux>= 6.12.23 < 6.12.256.12.25
linuxlinux>= 6.13.11 < 6.146.14
linuxlinux>= 6.14.2 < 6.14.46.14.4
linuxlinux>= 6.6.87 < 6.6.886.6.88
linuxlinux>= 9a81cde8c7ce65dd90fb47ceea93a45fc1a2fbd1 < 7d192e27a431026c58d60edf66dc6cd98d0c01fc7d192e27a431026c58d60edf66dc6cd98d0c01fc
linuxlinux>= b874cdef4e67e5150e07eff0eae1cbb21fb92da1 < b9bbe8f9d5663311d06667ce36d6ed255ead1a26b9bbe8f9d5663311d06667ce36d6ed255ead1a26
linuxlinux>= cad3479b63661a399c9df1d0b759e1806e2df3c8 < a7fce086f6ca84db409b9d58493ea77c1978897ca7fce086f6ca84db409b9d58493ea77c1978897c
linuxlinux>= cdb796137c57e68ca34518d53be53b679351eb86 < a70832d3555987035fc430ccd703acd89393eadba70832d3555987035fc430ccd703acd89393eadb
linuxlinux>= d96587cc93ec369031bcd7658c6adc719873c9fd < ba903539fff745d592d893c71b30e5e268a95413ba903539fff745d592d893c71b30e5e268a95413
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.237-15.10.237-1

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu3.2LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CVE-2025-37871 — Linux vulnerability | cvebase