01 Record

CVE-2025-22025

nfsd: put dl_stid if fail to queue dl_recall

HighPUBLISHEDCNA: Linux

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

nfsd: put dl_stid if fail to queue dl_recall

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.58% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 47.4% of scored records. A rank, not a probability.

NVD base score

5.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-15.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-04-16 14:11Z1 YR AGO

Last updated

2026-10-15 21:51Z13 DAYS AGO

Reserved

2024-12-29

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-401Missing Release of Memory after Effective LifetimeVariant

Data version

5.2

Document digest

42c8663d2021b93e0bbdf15ac7e80af968b0a2a699c300358f70b68a717439c6

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxb5a1a81e5c25fb6bb3fdc1812ba69ff6ab638fcf to < b874cdef4e67e5150e07eff0eae1cbb21fb92da1, b5a1a81e5c25fb6bb3fdc1812ba69ff6ab638fcf to < cdb796137c57e68ca34518d53be53b679351eb86, b5a1a81e5c25fb6bb3fdc1812ba69ff6ab638fcf to < d96587cc93ec369031bcd7658c6adc719873c9fd, b5a1a81e5c25fb6bb3fdc1812ba69ff6ab638fcf to < 9a81cde8c7ce65dd90fb47ceea93a45fc1a2fbd1, b5a1a81e5c25fb6bb3fdc1812ba69ff6ab638fcf to < cad3479b63661a399c9df1d0b759e1806e2df3c8, b5a1a81e5c25fb6bb3fdc1812ba69ff6ab638fcf to < 63b91c8ff4589f5263873b24c052447a28e10ef7, b5a1a81e5c25fb6bb3fdc1812ba69ff6ab638fcf to < 133f5e2a37ce08c82d24e8fba65e0a81deae4609, b5a1a81e5c25fb6bb3fdc1812ba69ff6ab638fcf to < 230ca758453c63bd38e4d9f4a21db698f7abada8, 2.6.35—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/b874cdef4e67e5150e07eff0eae1cbb21fb92da1
git.kernel.orghttps://git.kernel.org/stable/c/cdb796137c57e68ca34518d53be53b679351eb86
git.kernel.orghttps://git.kernel.org/stable/c/d96587cc93ec369031bcd7658c6adc719873c9fd
git.kernel.orghttps://git.kernel.org/stable/c/9a81cde8c7ce65dd90fb47ceea93a45fc1a2fbd1
git.kernel.orghttps://git.kernel.org/stable/c/cad3479b63661a399c9df1d0b759e1806e2df3c8
git.kernel.orghttps://git.kernel.org/stable/c/63b91c8ff4589f5263873b24c052447a28e10ef7
git.kernel.orghttps://git.kernel.org/stable/c/133f5e2a37ce08c82d24e8fba65e0a81deae4609
git.kernel.orghttps://git.kernel.org/stable/c/230ca758453c63bd38e4d9f4a21db698f7abada8
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/05/msg00045.html
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2025/05/msg00030.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.135-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.25-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.12.25-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.