CVE-2025-38724

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()<br /> <br /> Lei Lu recently reported that nfsd4_setclientid_confirm() did not check<br /> the return value from get_client_locked(). a SETCLIENTID_CONFIRM could<br /> race with a confirmed client expiring and fail to get a reference. That<br /> could later lead to a UAF.<br /> <br /> Fix this by getting a reference early in the case where there is an<br /> extant confirmed client. If that fails then treat it as if there were no<br /> confirmed client found at all.<br /> <br /> In the case where the unconfirmed client is expiring, just fail and<br /> return the result from get_client_locked().