{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-37871",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-37871",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-05-09T06:43:59.720Z",
    "updatedAt": "2026-08-05T11:57:57.052Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "nfsd: decrease sc_count directly if fail to queue dl_recall",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: decrease sc_count directly if fail to queue dl_recall\n\nA deadlock warning occurred when invoking nfs4_put_stid following a failed\ndl_recall queue operation:\n            T1                            T2\n                                nfs4_laundromat\n                                 nfs4_get_client_reaplist\n                                  nfs4_anylock_blockers\n__break_lease\n spin_lock // ctx->flc_lock\n                                   spin_lock // clp->cl_lock\n                                   nfs4_lockowner_has_blockers\n                                    locks_owner_has_blockers\n                                     spin_lock // flctx->flc_lock\n nfsd_break_deleg_cb\n  nfsd_break_one_deleg\n   nfs4_put_stid\n    refcount_dec_and_lock\n     spin_lock // clp->cl_lock\n\nWhen a file is opened, an nfs4_delegation is allocated with sc_count\ninitialized to 1, and the file_lease holds a reference to the delegation.\nThe file_lease is then associated with the file through kernel_setlease.\n\nThe disassociation is performed in nfsd4_delegreturn via the following\ncall chain:\nnfsd4_delegreturn --> destroy_delegation --> destroy_unhashed_deleg -->\nnfs4_unlock_deleg_lease --> kernel_setlease --> generic_delete_lease\nThe corresponding sc_count reference will be released after this\ndisassociation.\n\nSince nfsd_break_one_deleg executes while holding the flc_lock, the\ndisassociation process becomes blocked when attempting to acquire flc_lock\nin generic_delete_lease. This means:\n1) sc_count in nfsd_break_one_deleg will not be decremented to 0;\n2) The nfs4_put_stid called by nfsd_break_one_deleg will not attempt to\nacquire cl_lock;\n3) Consequently, no deadlock condition is created.\n\nGiven that sc_count in nfsd_break_one_deleg remains non-zero, we can\nsafely perform refcount_dec on sc_count directly. This approach\neffectively avoids triggering deadlock warnings.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "b874cdef4e67e5150e07eff0eae1cbb21fb92da1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b9bbe8f9d5663311d06667ce36d6ed255ead1a26"
            },
            {
              "version": "cdb796137c57e68ca34518d53be53b679351eb86",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a70832d3555987035fc430ccd703acd89393eadb"
            },
            {
              "version": "d96587cc93ec369031bcd7658c6adc719873c9fd",
              "status": "affected",
              "versionType": "git",
              "lessThan": "ba903539fff745d592d893c71b30e5e268a95413"
            },
            {
              "version": "9a81cde8c7ce65dd90fb47ceea93a45fc1a2fbd1",
              "status": "affected",
              "versionType": "git",
              "lessThan": "7d192e27a431026c58d60edf66dc6cd98d0c01fc"
            },
            {
              "version": "cad3479b63661a399c9df1d0b759e1806e2df3c8",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a7fce086f6ca84db409b9d58493ea77c1978897c"
            },
            {
              "version": "133f5e2a37ce08c82d24e8fba65e0a81deae4609",
              "status": "affected",
              "versionType": "git",
              "lessThan": "14985d66b9b99c12995dd99d1c6c8dec4114c2a5"
            },
            {
              "version": "230ca758453c63bd38e4d9f4a21db698f7abada8",
              "status": "affected",
              "versionType": "git",
              "lessThan": "a1d14d931bf700c1025db8c46d6731aa5cf440f9"
            },
            {
              "version": "63b91c8ff4589f5263873b24c052447a28e10ef7",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "6.13.11",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.14"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.10.236",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.10.237"
            },
            {
              "version": "5.15.180",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.15.181"
            },
            {
              "version": "6.1.134",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.1.135"
            },
            {
              "version": "6.6.87",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.6.88"
            },
            {
              "version": "6.12.23",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.12.25"
            },
            {
              "version": "6.14.2",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.14.4"
            }
          ]
        }
      ]
    }
  }
}