Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-37871— nfsd: decrease sc_count directly if fail to queue dl_recall

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nfsd未正确处理dl_recall队列失败，可能导致引用计数错误。

CVSS 7.5 · High EPSS 0.76% · P53

Affected Version Matrix 15

VendorProduct Version RangeStatus
Linux Linux b874cdef4e67e5150e07eff0eae1cbb21fb92da1< b9bbe8f9d5663311d06667ce36d6ed255ead1a26 affected
cdb796137c57e68ca34518d53be53b679351eb86< a70832d3555987035fc430ccd703acd89393eadb affected
d96587cc93ec369031bcd7658c6adc719873c9fd< ba903539fff745d592d893c71b30e5e268a95413 affected
9a81cde8c7ce65dd90fb47ceea93a45fc1a2fbd1< 7d192e27a431026c58d60edf66dc6cd98d0c01fc affected
cad3479b63661a399c9df1d0b759e1806e2df3c8< a7fce086f6ca84db409b9d58493ea77c1978897c affected
133f5e2a37ce08c82d24e8fba65e0a81deae4609< 14985d66b9b99c12995dd99d1c6c8dec4114c2a5 affected
230ca758453c63bd38e4d9f4a21db698f7abada8< a1d14d931bf700c1025db8c46d6731aa5cf440f9 affected
63b91c8ff4589f5263873b24c052447a28e10ef7 affected
… +7 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-37871

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nfsd: decrease sc_count directly if fail to queue dl_recall
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: decrease sc_count directly if fail to queue dl_recall A deadlock warning occurred when invoking nfs4_put_stid following a failed dl_recall queue operation: T1 T2 nfs4_laundromat nfs4_get_client_reaplist nfs4_anylock_blockers __break_lease spin_lock // ctx->flc_lock spin_lock // clp->cl_lock nfs4_lockowner_has_blockers locks_owner_has_blockers spin_lock // flctx->flc_lock nfsd_break_deleg_cb nfsd_break_one_deleg nfs4_put_stid refcount_dec_and_lock spin_lock // clp->cl_lock When a file is opened, an nfs4_delegation is allocated with sc_count initialized to 1, and the file_lease holds a reference to the delegation. The file_lease is then associated with the file through kernel_setlease. The disassociation is performed in nfsd4_delegreturn via the following call chain: nfsd4_delegreturn --> destroy_delegation --> destroy_unhashed_deleg --> nfs4_unlock_deleg_lease --> kernel_setlease --> generic_delete_lease The corresponding sc_count reference will be released after this disassociation. Since nfsd_break_one_deleg executes while holding the flc_lock, the disassociation process becomes blocked when attempting to acquire flc_lock in generic_delete_lease. This means: 1) sc_count in nfsd_break_one_deleg will not be decremented to 0; 2) The nfs4_put_stid called by nfsd_break_one_deleg will not attempt to acquire cl_lock; 3) Consequently, no deadlock condition is created. Given that sc_count in nfsd_break_one_deleg remains non-zero, we can safely perform refcount_dec on sc_count directly. This approach effectively avoids triggering deadlock warnings.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nfsd未正确处理dl_recall队列失败，可能导致引用计数错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b874cdef4e67e5150e07eff0eae1cbb21fb92da1 ~ b9bbe8f9d5663311d06667ce36d6ed255ead1a26 -
Linux Linux 5.10.236 ~ 5.10.237 -

II. Public POCs for CVE-2025-37871

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-37871

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-05-09 · 52 CVEs total

CVE-2025-37879 9.8 CRITICAL 9p/net: fix improper handling of bogus negative read/write replies
CVE-2025-37885 8.8 HIGH KVM: x86: Reset IRTE to host control if *new* route isn't postable
CVE-2025-37849 8.8 HIGH KVM: arm64: Tear down vGIC on failed vCPU creation
CVE-2025-37856 7.8 HIGH btrfs: harden block_group::bg_list against list_del() races
CVE-2025-37886 7.8 HIGH pds_core: make wait_context part of q_info
CVE-2025-37869 7.8 HIGH drm/xe: Use local fence in error path of xe_migrate_clear
CVE-2025-37854 7.8 HIGH drm/amdkfd: Fix mode1 reset crash issue
CVE-2025-37845 7.8 HIGH tracing: fprobe events: Fix possible UAF on modules
CVE-2025-37882 7.8 HIGH usb: xhci: Fix isochronous Ring Underrun/Overrun event handling
CVE-2025-37861 7.8 HIGH scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
CVE-2025-37873 7.8 HIGH eth: bnxt: fix missing ring index trim on error path
CVE-2025-37887 7.1 HIGH pds_core: handle unsupported PDS_CORE_CMD_FW_CONTROL result
CVE-2025-37876 7.0 HIGH netfs: Only create /proc/fs/netfs with CONFIG_PROC_FS
CVE-2025-37888 net/mlx5: Fix null-ptr-deref in mlx5_create_{inner_,}ttc_table()
CVE-2025-37878 perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init
CVE-2025-37874 net: ngbe: fix memory leak in ngbe_probe() error path
CVE-2025-37872 net: txgbe: fix memory leak in txgbe_probe() error path
CVE-2025-37870 drm/amd/display: prevent hang on link training fail
CVE-2025-37868 drm/xe/userptr: fix notifier vs folio deadlock
CVE-2025-37867 RDMA/core: Silence oversized kvmalloc() warning

Showing top 20 of 52 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-37871

No comments yet

Leave a comment