CVE-2025-38724: linux kernel from 3.17 (inclusive), before 5.4.297 (exclusive), from 5.5 (inclusive), before 5.10.241 (exclusive)…

Affected technology

linux kernel · from 3.17 (inclusive), before 5.4.297 (exclusive)
linux

linux kernel · from 5.5 (inclusive), before 5.10.241 (exclusive)
linux

linux kernel · from 5.11 (inclusive), before 5.15.190 (exclusive)
linux

linux kernel · from 5.16 (inclusive), before 6.1.149 (exclusive)
linux

linux kernel · from 6.2 (inclusive), before 6.6.103 (exclusive)
linux

linux kernel · from 6.7 (inclusive), before 6.12.43 (exclusive)
linux

linux kernel · from 6.13 (inclusive), before 6.15.11 (exclusive)
linux

linux kernel · from 6.16 (inclusive), before 6.16.2 (exclusive)
linux

debian linux · 11.0
debian

Linux · d20c11d86d8f821a64eac7d6c8f296f06d935f4f to before 3f252a73e81aa01660cb426735eab932e6182e8d, d20c11d86d8f821a64eac7d6c8f296f06d935f4f to before d35ac850410966010e92f401f4e21868a9ea4d8b, d20c11d86d8f821a64eac7d6c8f296f06d935f4f to before f3aac6cf390d8b80e1d82975faf4ac61175519c0, d20c11d86d8f821a64eac7d6c8f296f06d935f4f to before 22f45cedf281e6171817c8a3432c44d788c550e1, d20c11d86d8f821a64eac7d6c8f296f06d935f4f to before d71abd1ae4e0413707cd42b10c24a11d1aa71772, d20c11d86d8f821a64eac7d6c8f296f06d935f4f to before 74ad36ed60df561a303a19ecef400c7096b20306, d20c11d86d8f821a64eac7d6c8f296f06d935f4f to before 36e83eda90e0e4ac52f259f775b40b2841f8a0a3, d20c11d86d8f821a64eac7d6c8f296f06d935f4f to before 571a5e46c71490285d2d8c06f6b5a7cbf6c7edd1, d20c11d86d8f821a64eac7d6c8f296f06d935f4f to before 908e4ead7f757504d8b345452730636e298cbf68
Linux

Linux · 3.17
Linux

SIMATIC CN 4100 · 0 to before V5.0
Siemens

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.5 to before *
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.5 to before *
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.5 to before *
Siemens

Component: Not specified by the source
File: fs/nfsd/nfs4state.c

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.