CVE-2025-21900

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21900", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.783Z", "datePublished": "2025-04-01T15:26:51.290Z", "dateUpdated": "2026-08-05T11:55:15.442Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:15.442Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix a deadlock when recovering state on a sillyrenamed file\n\nIf the file is sillyrenamed, and slated for delete on close, it is\npossible for a server reboot to triggeer an open reclaim, with can again\nrace with the application call to close(). When that happens, the call\nto put_nfs_open_context() can trigger a synchronous delegreturn call\nwhich deadlocks because it is not marked as privileged.\n\nInstead, ensure that the call to nfs4_inode_return_delegation_on_close()\ncatches the delegreturn, and schedules it asynchronously."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - This is NFSv4 client code whose vulnerable path is entered only in response to remote server behaviour \u2014 a server reboot/session reset (NFS4ERR_STALE_CLIENTID, NFS4ERR_BAD_SESSION, lease expiry) drives the state manager into open reclaim, and the blocking DELEGRETURN is an RPC to that server. A malicious or compromised NFS server, or an on-path attacker on a typical AUTH_SYS mount, can force state recovery at will over the network.\nAC:L - This is not a tight instruction-level race: the state manager holds the open-context reference across a full OPEN reclaim round trip whose duration the server chooses, and it can be stretched further with NFS4ERR_DELAY/NFS4ERR_GRACE, so the attacker controls the window width and can force recovery repeatedly until the race lands. The other side \u2014 an open, unlinked (sillyrenamed) file being closed \u2014 is ubiquitous in normal workloads (tmpfile(), mkstemp+unlink, editors, build systems, mail spools).\nPR:N - The attacker is the remote NFS server (or an on-path attacker) and needs no credentials or account on the victim client; the mount is a pre-existing deployment condition. Even under a purely local framing this would only require an unprivileged user, so no elevated privilege is needed on any path.\nUI:N - No human action is required \u2014 the attacker forces state recovery, and the sillyrename/close side is satisfied by ordinary background filesystem activity already running on the client.\nS:U - The deadlock is confined to the NFS client kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - This is purely a lock/RPC-ordering deadlock with no memory corruption, out-of-bounds access, or uninitialized data exposure. No information is disclosed to the attacker.\nI:N - No attacker-controlled data modification occurs; nothing is written out of bounds and no state is corrupted in an attacker-directed way. The pending silly-delete simply never completes.\nA:H - The NFSv4 state manager kthread deadlocks permanently with the session slot table left in the draining state, so every subsequent NFSv4 RPC to that server blocks forever \u2014 all processes touching any mount from that nfs_client hang unkillably in D state, umount and clean shutdown wedge, and recovery requires a hard reboot. On NFS-root systems (diskless workstations, HPC nodes, thin clients, embedded controllers) this hangs the entire machine."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/delegation.c", "fs/nfs/delegation.h", "fs/nfs/nfs4proc.c"], "versions": [{"version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc", "lessThan": "4fe4ae6c2e01d028856b73b6328b12b8945df871", "status": "affected", "versionType": "git"}, {"version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc", "lessThan": "f41a60bc43e7abbc636fee78bed0d74c31e738b0", "status": "affected", "versionType": "git"}, {"version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc", "lessThan": "8f8df955f078e1a023ee55161935000a67651f38", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/delegation.c", "fs/nfs/delegation.h", "fs/nfs/nfs4proc.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.18", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.6", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.13.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4fe4ae6c2e01d028856b73b6328b12b8945df871"}, {"url": "https://git.kernel.org/stable/c/f41a60bc43e7abbc636fee78bed0d74c31e738b0"}, {"url": "https://git.kernel.org/stable/c/8f8df955f078e1a023ee55161935000a67651f38"}], "title": "NFSv4: Fix a deadlock when recovering state on a sillyrenamed file", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-667", "lang": "en", "description": "CWE-667 Improper Locking"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-01T17:18:02.848036Z", "id": "CVE-2025-21900", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T17:18:05.662Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21900", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T17:18:02.848036Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-667", "description": "CWE-667 Improper Locking"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T14:37:22.348Z"}}], "cna": {"title": "NFSv4: Fix a deadlock when recovering state on a sillyrenamed file", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - This is NFSv4 client code whose vulnerable path is entered only in response to remote server behaviour \u2014 a server reboot/session reset (NFS4ERR_STALE_CLIENTID, NFS4ERR_BAD_SESSION, lease expiry) drives the state manager into open reclaim, and the blocking DELEGRETURN is an RPC to that server. A malicious or compromised NFS server, or an on-path attacker on a typical AUTH_SYS mount, can force state recovery at will over the network.\nAC:L - This is not a tight instruction-level race: the state manager holds the open-context reference across a full OPEN reclaim round trip whose duration the server chooses, and it can be stretched further with NFS4ERR_DELAY/NFS4ERR_GRACE, so the attacker controls the window width and can force recovery repeatedly until the race lands. The other side \u2014 an open, unlinked (sillyrenamed) file being closed \u2014 is ubiquitous in normal workloads (tmpfile(), mkstemp+unlink, editors, build systems, mail spools).\nPR:N - The attacker is the remote NFS server (or an on-path attacker) and needs no credentials or account on the victim client; the mount is a pre-existing deployment condition. Even under a purely local framing this would only require an unprivileged user, so no elevated privilege is needed on any path.\nUI:N - No human action is required \u2014 the attacker forces state recovery, and the sillyrename/close side is satisfied by ordinary background filesystem activity already running on the client.\nS:U - The deadlock is confined to the NFS client kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - This is purely a lock/RPC-ordering deadlock with no memory corruption, out-of-bounds access, or uninitialized data exposure. No information is disclosed to the attacker.\nI:N - No attacker-controlled data modification occurs; nothing is written out of bounds and no state is corrupted in an attacker-directed way. The pending silly-delete simply never completes.\nA:H - The NFSv4 state manager kthread deadlocks permanently with the session slot table left in the draining state, so every subsequent NFSv4 RPC to that server blocks forever \u2014 all processes touching any mount from that nfs_client hang unkillably in D state, umount and clean shutdown wedge, and recovery requires a hard reboot. On NFS-root systems (diskless workstations, HPC nodes, thin clients, embedded controllers) this hangs the entire machine."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc", "lessThan": "4fe4ae6c2e01d028856b73b6328b12b8945df871", "versionType": "git"}, {"status": "affected", "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc", "lessThan": "f41a60bc43e7abbc636fee78bed0d74c31e738b0", "versionType": "git"}, {"status": "affected", "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc", "lessThan": "8f8df955f078e1a023ee55161935000a67651f38", "versionType": "git"}], "programFiles": ["fs/nfs/delegation.c", "fs/nfs/delegation.h", "fs/nfs/nfs4proc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.18", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.6", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfs/delegation.c", "fs/nfs/delegation.h", "fs/nfs/nfs4proc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4fe4ae6c2e01d028856b73b6328b12b8945df871"}, {"url": "https://git.kernel.org/stable/c/f41a60bc43e7abbc636fee78bed0d74c31e738b0"}, {"url": "https://git.kernel.org/stable/c/8f8df955f078e1a023ee55161935000a67651f38"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix a deadlock when recovering state on a sillyrenamed file\n\nIf the file is sillyrenamed, and slated for delete on close, it is\npossible for a server reboot to triggeer an open reclaim, with can again\nrace with the application call to close(). When that happens, the call\nto put_nfs_open_context() can trigger a synchronous delegreturn call\nwhich deadlocks because it is not marked as privileged.\n\nInstead, ensure that the call to nfs4_inode_return_delegation_on_close()\ncatches the delegreturn, and schedules it asynchronously."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.18", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.6", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "6.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:15.442Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21900", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:55:15.442Z", "dateReserved": "2024-12-29T08:45:45.783Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-04-01T15:26:51.290Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfs/delegation.c", "fs/nfs/delegation.h", "fs/nfs/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4fe4ae6c2e01d028856b73b6328b12b8945df871", "status": "affected", "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc", "versionType": "git"}, {"lessThan": "f41a60bc43e7abbc636fee78bed0d74c31e738b0", "status": "affected", "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc", "versionType": "git"}, {"lessThan": "8f8df955f078e1a023ee55161935000a67651f38", "status": "affected", "version": "adb4b42d19aea91826621a8d0bac94cf2c08f8bc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfs/delegation.c", "fs/nfs/delegation.h", "fs/nfs/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.18", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5B351D2-724D-4334-AC35-A9017217FE4A", "versionEndExcluding": "6.12.18", "versionStartIncluding": "6.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "64F12D9B-71C2-4CD7-A288-0D5EF1709620", "versionEndExcluding": "6.13.6", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*", "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*", "matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*", "matchCriteriaId": "D3D6550E-6679-4560-902D-AF52DCFE905B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4: Fix a deadlock when recovering state on a sillyrenamed file\n\nIf the file is sillyrenamed, and slated for delete on close, it is\npossible for a server reboot to triggeer an open reclaim, with can again\nrace with the application call to close(). When that happens, the call\nto put_nfs_open_context() can trigger a synchronous delegreturn call\nwhich deadlocks because it is not marked as privileged.\n\nInstead, ensure that the call to nfs4_inode_return_delegation_on_close()\ncatches the delegreturn, and schedules it asynchronously."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: NFSv4: Se corrige un bloqueo al recuperar el estado de un archivo con un nombre sillyrenombrado. Si el archivo tiene un nombre sillyrenombrado y se programa para eliminarse al cerrarse, es posible que un reinicio del servidor active una recuperaci\u00f3n abierta, que puede competir con la llamada de la aplicaci\u00f3n a close(). En este caso, la llamada a put_nfs_open_context() puede activar una llamada delegreturn s\u00edncrona que se bloquea al no estar marcada como privilegiada. En su lugar, aseg\u00farese de que la llamada a nfs4_inode_return_delegation_on_close() capture la devoluci\u00f3n delegreturn y la programe de forma as\u00edncrona."}], "id": "CVE-2025-21900", "lastModified": "2026-07-30T06:21:56.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21900", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T17:18:02.848036Z", "version": "2.0.3"}}]}, "published": "2025-04-01T16:15:20.440", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4fe4ae6c2e01d028856b73b6328b12b8945df871"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8f8df955f078e1a023ee55161935000a67651f38"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f41a60bc43e7abbc636fee78bed0d74c31e738b0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-667"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: NFSv4: Fix a deadlock when recovering state on a sillyrenamed file", "id": "2356667", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2356667"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-667", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nNFSv4: Fix a deadlock when recovering state on a sillyrenamed file\nIf the file is sillyrenamed, and slated for delete on close, it is\npossible for a server reboot to triggeer an open reclaim, with can again\nrace with the application call to close(). When that happens, the call\nto put_nfs_open_context() can trigger a synchronous delegreturn call\nwhich deadlocks because it is not marked as privileged.\nInstead, ensure that the call to nfs4_inode_return_delegation_on_close()\ncatches the delegreturn, and schedules it asynchronously."], "name": "CVE-2025-21900", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-04-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21900\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21900\nhttps://lore.kernel.org/linux-cve-announce/2025040133-CVE-2025-21900-8d31@gregkh/T"], "threat_severity": "Moderate"}

{}