CVE-2025-21795

What it actually does

Causes nfsd4_shutdown_callback to hang indefinitely when an nfs4_client is in courtesy state because cl_cb_inflight remains nonzero; the hang resolves only after a 15-minute TCP timeout notifies NFSD of the dropped connection.

Why it matters to the business

NFS server shutdowns can stall for up to 15 minutes, producing extended file-service outages that interrupt dependent applications and workflows until the kernel recovers or is restarted.

How an attack unfolds

An attacker with local or network access that can place an NFS client into courtesy state triggers the buggy shutdown path in nfsd4_run_cb_work; the RPC call is never skipped, the inflight counter never reaches zero, and the server thread blocks until the TCP timeout fires.

How to fix it

Upgrade the Linux kernel to a fixed release such as 5.10.235 or apply the patch corresponding to commit abed68027ea3ab893ac85cc46a00e2e64a324239; rebuild and reboot affected systems; verify the courtesy-state check exists in nfsd4_run_cb_work after the update.

How to confirm the fix worked

Confirm the running kernel version contains the courtesy-state guard; reproduce a courtesy-state client and measure shutdown duration to ensure it completes without a 15-minute hang; inspect dmesg or nfsd logs for absence of the prior timeout behavior.

Typical attack path

1. Place or observe an nfs4_client entering courtesy state
2. Invoke nfsd4_shutdown_callback on the NFSD server
3. Observe the RPC call skipped logic fail and cl_cb_inflight stay nonzero
4. Wait for the 15-minute TCP notification to unblock the thread

How to detect it

Search kernel and nfsd logs for repeated callback shutdown entries followed by TCP connection-drop notifications approximately 15 minutes later; correlate with system shutdown or nfsd restart events.

What your security team should do

• Prioritize kernel upgrades on all systems exposing NFS services
• Schedule maintenance windows to apply the fix before the next planned shutdown
• Add kernel version checks to automated compliance scans
• Review NFS client courtesy-state handling in monitoring dashboards