Deadlock Vulnerability in Linux Kernel NFSv4 - Package: linux
Summary
DEBIAN-CVE-2025-21900: In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a deadlock when recovering state on a sillyrenamed file If the file is sillyrenamed, and slated for delete on close, it is possible for a ser... Affects linux versions < 6.12.19-1. Fixed in 6.12.19-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device control. The kernel is highly modular and supports a wide range of hardware architectures. This vulnerability specifically affects the NFSv4 (Network File System version 4) component, which allows file sharing over a network. The vulnerability arises from a deadlock scenario when handling a 'sillyrenamed' file during state recovery.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the NFSv4 implementation that can lead to a deadlock situation. This occurs when a file is marked for deletion upon closing, and a server reboot triggers an open reclaim process. This process can race with the application’s close call, leading to a situation where the call to put_nfs_open_context() invokes a synchronous delegreturn call that is not marked as privileged, resulting in a deadlock. The ramifications of this vulnerability can include system hangs and unresponsive states, impacting the availability of services relying on NFSv4.
How To Fix
Minimum fixed version
6.12.19-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The deadlock vulnerability in the Linux kernel's NFSv4 implementation poses a significant risk to system stability and availability. Users are strongly encouraged to update to the patched version 6.12.19-1 to protect their systems from potential exploitation. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a deadlock issue in the NFSv4 implementation of the Linux kernel, which can occur during state recovery of a sillyrenamed file.
If exploited, this vulnerability can lead to system hangs and unresponsive states, particularly affecting services that rely on NFSv4 for file sharing.
Yes, the vulnerability has been fixed in version 6.12.19-1 of the Linux package. Users are advised to update to this version.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
