CVE-2025-38724

What it actually does

Missing return-value check on get_client_locked() in nfsd4_setclientid_confirm() allows a SETCLIENTID_CONFIRM operation to race with expiration of a confirmed client, resulting in a use-after-free of the client structure.

Why it matters to the business

Local attackers on affected Linux systems running the NFS server can achieve privilege escalation and full host compromise; the flaw affects container-optimized kernels and certain Argo CD FIPS deployments, increasing urgency for organizations relying on those environments.

How an attack unfolds

An attacker with local access issues a SETCLIENTID_CONFIRM while simultaneously triggering expiration of a confirmed client; the unchecked failure path leaves a dangling reference that is later dereferenced, causing a use-after-free that can be turned into arbitrary kernel read/write and privilege escalation. Similar techniques have been observed in campaigns by groups such as VMSCAPE and related container-focused privilege-escalation efforts.

How to fix it

Upgrade to a fixed kernel containing commit 3f252a73e81aa01660cb426735eab932e6182e8d or later; for argocd-fips-2.14 variants on MinimOS apply version 2.14.15-r5 or newer. Reboot after kernel updates and verify the NFS server no longer contains the vulnerable get_client_locked() call site.

How to confirm the fix worked

Confirm the running kernel contains commit 3f252a73e81aa01660cb426735eab932e6182e8d; inspect nfsd4_setclientid_confirm() source to ensure the get_client_locked() return value is checked before use; test that SETCLIENTID_CONFIRM operations on expiring clients now return the appropriate error instead of dereferencing freed memory.

Typical attack path

1. Obtain local shell on a system exposing the vulnerable NFS server code path
2. Trigger or wait for a confirmed client to enter the expiration window
3. Issue a SETCLIENTID_CONFIRM operation that races with the expiration
4. Exploit the resulting dangling reference to achieve kernel memory corruption
5. Escalate to root and establish persistence or move laterally

How to detect it

Review kernel logs and audit records for unusual NFS SETCLIENTID_CONFIRM failures or crashes around client expiration events; correlate with process activity that opens NFS-related sockets or calls nfsd functions; look for post-exploitation artifacts such as unexpected root shells or kernel module loads following NFS activity.

What your security team should do

• Prioritize patching all affected Linux kernels and Argo CD FIPS instances within the next maintenance window
• Restrict local access to systems exposing NFS server functionality until patches are applied
• Monitor for new exploit maturity indicators given the 418 days since publication and steady EPSS trend
• Review container-optimized OS deployments for similar NFS-related race conditions