Linux Kernel NFSv3/v4 Use-After-Free Local Privilege Escalation (CVE-2025-21756)

CVE-2025-21756 is a use-after-free in the Linux kernel NFS client subsystem. Local attackers with user shell on NFS-mounted Linux servers can escalate to root — relevant for NAS clients, render farms, and HPC nodes.

Affected kernels

• Linux 6.12.x before 6.12.13
• Linux 6.6.x before 6.6.75 (stable backports vary by distro)
• Hosts with NFS mounts (mount | grep nfs)

Verify exposure

uname -r
mount | grep nfs
rpm -q kernel 2>/dev/null | tail -1
apt list --installed 2>/dev/null | grep linux-image | tail -2

Patching Method

Ubuntu / Debian

sudo apt update
sudo apt install --only-upgrade linux-image-$(uname -r)
# or install latest HWE/security metapackage
sudo apt install linux-image-generic
sudo reboot

RHEL / AlmaLinux / Rocky

sudo dnf update --security kernel*
sudo reboot
uname -r   # confirm new kernel after reboot

Verify fix

uname -r
grep CVE-2025-21756 /usr/share/doc/kernel*/changelog* 2>/dev/null || \
  rpm -q --changelog kernel | grep -i 21756

Workarounds if reboot is delayed

• Unmount non-essential NFS shares temporarily
• Restrict local shell access on multi-tenant NFS clients
• Monitor for suspicious nfs / modprobe activity