SECUFOCUSNOW
Home›CVE index›CVE-2025-21796
Review reviewCritical

CVE-2025-21796

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28 refcount_warn_saturate+0xb5/0x170 Modules linked in: CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted 6.12.0-r...

CVSS
9.8
EPSS
0.63%
46.5% percentile
CISA KEV
Not listed
Published
2025.02.27
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.63%
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a pointer pointing to the released posix_acl, which will trigger a WARNING in nfs3svc_release_getacl like this: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 26 PID: 3199 at lib/refcount.c:28 refcount_warn_saturate+0xb5/0x170 Modules linked in: CPU: 26 UID: 0 PID: 3199 Comm: nfsd Not tainted 6.12.0-r...

Affected product and versions

Product
Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Affected versions
>= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 8a1737ae42c928384ab6447f6ee1a882510e85fa, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 6f7cfee1a316891890c505563aa54f3476db52fd, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 2e59b2b68782519560b3d6a41dd66a3d01a01cd3, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 55d947315fb5f67a35e4e1d3e01bb886b9c6decf, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < f8d871523142f7895f250a856f8c4a4181614510, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 1fd94884174bd20beb1773990fd3b1aa877688d9, >= a257cdd0e2179630d3201c32ba14d7fcb3c3a055 < 7faf14a7b0366f153284db0ad3347c457ea70136, >= 2.6.13, >= V3.1.5, >= V3.1.6, >= 2.6.13 < 5.10.235, >= 5.11 < 5.15.179, >= 5.16 < 6.1.129, >= 6.2 < 6.6.79, >= 6.7 < 6.12.16, >= 6.13 < 6.13.4, 6.14
Fixed versions
5.10.235, 5.15.179, 6.1.129, 6.6.79, 6.12.16, 6.13.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416