CVE-2025-40210 (GCVE-0-2025-40210)

Vulnerability from cvelistv5 – Published: 2025-11-21 10:21 – Updated: 2026-08-05 12:08
VLAI
Title
Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"
Summary
In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"). Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in: [ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 when NFSD attempts to allocate the COMPOUND op array. Let's restore the operation-per-COMPOUND limit, but increased to 200 for now.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 48aab1606fa80027143a445224f552b4eeea845b , < b3ee7ce432289deac87b9d14e01f2fe6958f7f0b (git)
Affected: 48aab1606fa80027143a445224f552b4eeea845b , < 3e7f011c255582d7c914133785bbba1990441713 (git)
Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/nfs4xdr.c",
            "fs/nfsd/nfsd.h",
            "fs/nfsd/xdr4.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3ee7ce432289deac87b9d14e01f2fe6958f7f0b",
              "status": "affected",
              "version": "48aab1606fa80027143a445224f552b4eeea845b",
              "versionType": "git"
            },
            {
              "lessThan": "3e7f011c255582d7c914133785bbba1990441713",
              "status": "affected",
              "version": "48aab1606fa80027143a445224f552b4eeea845b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/nfs4xdr.c",
            "fs/nfsd/nfsd.h",
            "fs/nfsd/xdr4.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"\n\nI\u0027ve found that pynfs COMP6 now leaves the connection or lease in a\nstrange state, which causes CLOSE9 to hang indefinitely. I\u0027ve dug\ninto it a little, but I haven\u0027t been able to root-cause it yet.\nHowever, I bisected to commit 48aab1606fa8 (\"NFSD: Remove the cap on\nnumber of operations per NFSv4 COMPOUND\").\n\nTianshuo Han also reports a potential vulnerability when decoding\nan NFSv4 COMPOUND. An attacker can place an arbitrarily large op\ncount in the COMPOUND header, which results in:\n\n[   51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total\npages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO),\nnodemask=(null),cpuset=/,mems_allowed=0\n\nwhen NFSD attempts to allocate the COMPOUND op array.\n\nLet\u0027s restore the operation-per-COMPOUND limit, but increased to 200\nfor now."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the NFSv4 COMPOUND XDR decoder in the in-kernel NFS server, driven directly by bytes received on TCP/UDP port 2049 from a remote client. No local access is needed.\nAC:L - A single malformed COMPOUND header with a large 32-bit op count deterministically triggers the unbounded vcalloc; the attacker fully controls the requested size and can tune it to either fail loudly or succeed and pin gigabytes.\nPR:N - The allocation occurs during XDR decode, before any export, filehandle, or file-permission check, and the only gate is `svc_set_client`\u0027s IP-based export ACL \u2014 not a user credential. Under the standard AUTH_SYS flavor no secret or account on the server is required.\nUI:N - The attacker only needs to send an RPC to the listening nfsd port; no action by any local user or administrator is involved.\nS:U - The impact is confined to the NFS server kernel\u0027s own memory and scheduling resources, with no crossing into another security authority such as a hypervisor or IOMMU boundary.\nC:N - `size_mul()` saturates instead of wrapping, so the array is never undersized; there is no out-of-bounds read, no uninitialized memory exposure, and nothing is returned to the attacker beyond a garbage-args RPC error.\nI:N - No attacker-controlled data is written outside the correctly sized allocation and no filesystem or kernel state is modified \u2014 the request is rejected once decode fails.\nA:H - An unauthenticated remote client can force arbitrarily large `GFP_KERNEL|__GFP_ZERO` vmalloc requests, exhausting kernel memory and triggering OOM kills, reclaim stalls and allocation-failure splats across all nfsd threads; the same regression also produces the reported indefinite CLOSE hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:36.344Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3ee7ce432289deac87b9d14e01f2fe6958f7f0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e7f011c255582d7c914133785bbba1990441713"
        }
      ],
      "title": "Revert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40210",
    "datePublished": "2025-11-21T10:21:35.540Z",
    "dateReserved": "2025-04-16T07:20:57.179Z",
    "dateUpdated": "2026-08-05T12:08:36.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40210",
      "date": "2026-08-05",
      "epss": "0.00327",
      "percentile": "0.25105"
    },
    "microsoft_vex": {
      "current_release_date": "2025-11-25T01:39:58.000Z",
      "cve": "CVE-2025-40210",
      "id": "msrc_CVE-2025-40210",
      "initial_release_date": "2025-11-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Revert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40210.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40210\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-11-21T11:15:49.110\",\"lastModified\":\"2026-07-30T06:24:18.010\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRevert \\\"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\\\"\\n\\nI\u0027ve found that pynfs COMP6 now leaves the connection or lease in a\\nstrange state, which causes CLOSE9 to hang indefinitely. I\u0027ve dug\\ninto it a little, but I haven\u0027t been able to root-cause it yet.\\nHowever, I bisected to commit 48aab1606fa8 (\\\"NFSD: Remove the cap on\\nnumber of operations per NFSv4 COMPOUND\\\").\\n\\nTianshuo Han also reports a potential vulnerability when decoding\\nan NFSv4 COMPOUND. An attacker can place an arbitrarily large op\\ncount in the COMPOUND header, which results in:\\n\\n[   51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total\\npages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO),\\nnodemask=(null),cpuset=/,mems_allowed=0\\n\\nwhen NFSD attempts to allocate the COMPOUND op array.\\n\\nLet\u0027s restore the operation-per-COMPOUND limit, but increased to 200\\nfor now.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\",\"fs/nfsd/nfs4state.c\",\"fs/nfsd/nfs4xdr.c\",\"fs/nfsd/nfsd.h\",\"fs/nfsd/xdr4.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"48aab1606fa80027143a445224f552b4eeea845b\",\"lessThan\":\"b3ee7ce432289deac87b9d14e01f2fe6958f7f0b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48aab1606fa80027143a445224f552b4eeea845b\",\"lessThan\":\"3e7f011c255582d7c914133785bbba1990441713\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfs4proc.c\",\"fs/nfsd/nfs4state.c\",\"fs/nfsd/nfs4xdr.c\",\"fs/nfsd/nfsd.h\",\"fs/nfsd/xdr4.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.8\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3e7f011c255582d7c914133785bbba1990441713\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b3ee7ce432289deac87b9d14e01f2fe6958f7f0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:48:01+00:00",
      "cve": "CVE-2025-40210",
      "id": "CVE-2025-40210",
      "initial_release_date": "2025-11-21T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_affected": "25",
      "product_status:known_not_affected": "173",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Revert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40210.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.