CVE-2025-21796

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: clear acl_access/acl_default after releasing them

If getting acl_default fails, acl_access and acl_default will be released

simultaneously. However, acl_access will still retain a pointer pointing

to the released posix_acl, which will trigger a WARNING in

nfs3svc_release_getacl like this:

------------[ cut here ]------------

refcount_t: underflow; use-after-free.

WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28

refcount_warn_saturate+0xb5/0x170

Modules linked in:

CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted

6.12.0-rc6-00079-g04ae226af01f-dirty #8

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS

1.16.1-2.fc37 04/01/2014

RIP: 0010:refcount_warn_saturate+0xb5/0x170

Code: cc cc 0f b6 1d b3 20 a5 03 80 fb 01 0f 87 65 48 d8 00 83 e3 01 75

e4 48 c7 c7 c0 3b 9b 85 c6 05 97 20 a5 03 01 e8 fb 3e 30 ff <0f> 0b eb

cd 0f b6 1d 8a3

RSP: 0018:ffffc90008637cd8 EFLAGS: 00010282

RAX: 0000000000000000 RBX: 000000000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References