# CVE-2025-38724: Linux Kernel nfsd use-after-free in nfsd4_setclientid_confirm

Source: https://junglewise.ai/threats/cve-2025-38724-linux-kernel-nfsd-use-after-free-in-nfsd4-setclientid-confirm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-04. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2025-38724 · Severity: critical · CVSS 9.8 · Published 2025-09-04

A vulnerability exists in the Linux kernel's Network File System (NFS) server component, which is used to share files across a network. A flaw in how the server handles client identification requests can lead to a system crash or allow unauthorized access to memory. This could result in a complete service outage or the theft of sensitive data stored on the server.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC CN 4100](https://junglewise.ai/threats/technologies/simatic-cn-4100), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-38724 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-38724 being exploited in the wild.

**How severe is CVE-2025-38724?** Critical severity, with a CVSS score of 9.8, published 4 September 2025.

**Which products and versions are affected?** Linux Kernel 3.17 to 5.4.297, 5.5 to 5.10.241, 5.11 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.43, 6.13 to 6.15.11, 6.16 to 6.16.2, versions prior to 6.14-rc1 (fixed in various stable branches); Siemens SIMATIC CN 4100 versions prior to V5.0; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later.

**Is there a fix for CVE-2025-38724?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-38724 attacked?** It is attacked over the network or with local access, in an operating system.

**Am I affected by CVE-2025-38724?** Check whether you run Linux Kernel, Siemens SIMATIC CN 4100 or Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's NFSD (NFS server) implementation within the nfsd4_setclientid_confirm() function. The root cause is a failure to check the return value of get_client_locked(), allowing a SETCLIENTID_CONFIRM request to race with a confirmed client's expiration. If the race occurs, the system may attempt to use a reference to a client object that has already been freed. An attacker can exploit this via network-based NFS requests to cause a kernel panic (DoS) or potentially achieve arbitrary code execution. Patches have been released across multiple stable kernel branches (e.g., 6.1, 6.6, 6.10, 6.11).

## Affected products

- Linux Linux Kernel versions prior to 6.14-rc1 (fixed in various stable branches)
- Siemens SIMATIC CN 4100 versions prior to V5.0
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5 and later

## Timeline

- 2025-06-04: other: Initial patch authored
- 2025-09-04: disclosed: CVE published

## References

- [https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1](https://git.kernel.org/stable/c/22f45cedf281e6171817c8a3432c44d788c550e1)
- [https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3](https://git.kernel.org/stable/c/36e83eda90e0e4ac52f259f775b40b2841f8a0a3)
- [https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8d](https://git.kernel.org/stable/c/3f252a73e81aa01660cb426735eab932e6182e8d)
- [https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1](https://git.kernel.org/stable/c/571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1)
- [https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306](https://git.kernel.org/stable/c/74ad36ed60df561a303a19ecef400c7096b20306)
- [https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68](https://git.kernel.org/stable/c/908e4ead7f757504d8b345452730636e298cbf68)
- [https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8b](https://git.kernel.org/stable/c/d35ac850410966010e92f401f4e21868a9ea4d8b)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)