PT-2025-8908 · Linux+10 · Linux Kernel+10
Li Lingfeng
·
Published
2025-01-26
·
Updated
2026-04-20
·
CVE-2025-21796
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.12.0-rc6
Description
A use-after-free issue exists in the Linux kernel. When
posix acl release is called, acl access and acl default are released simultaneously. However, acl access retains a pointer to the released posix acl, triggering a warning in nfs3svc release getacl. This can lead to a kernel panic.Recommendations
For Linux kernel versions prior to 6.12.0-rc6, clear
acl access and acl default after posix acl release is called to prevent the use-after-free issue. As a temporary workaround, consider disabling the nfsd service until a patch is available.Exploit
Fix
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu