CVE-2025-40326 (GCVE-0-2025-40326)

Vulnerability from cvelistv5 – Published: 2025-12-08 00:46 – Updated: 2026-08-05 12:09
VLAI
Title
NFSD: Define actions for the new time_deleg FATTR4 attributes
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSD: Define actions for the new time_deleg FATTR4 attributes NFSv4 clients won't send legitimate GETATTR requests for these new attributes because they are intended to be used only with CB_GETATTR and SETATTR. But NFSD has to do something besides crashing if it ever sees a GETATTR request that queries these attributes. RFC 8881 Section 18.7.3 states: > The server MUST return a value for each attribute that the client > requests if the attribute is supported by the server for the > target file system. If the server does not support a particular > attribute on the target file system, then it MUST NOT return the > attribute value and MUST NOT set the attribute bit in the result > bitmap. The server MUST return an error if it supports an > attribute on the target but cannot obtain its value. In that case, > no attribute values will be returned. Further, RFC 9754 Section 5 states: > These new attributes are invalid to be used with GETATTR, VERIFY, > and NVERIFY, and they can only be used with CB_GETATTR and SETATTR > by a client holding an appropriate delegation. Thus there does not appear to be a specific server response mandated by specification. Taking the guidance that querying these attributes via GETATTR is "invalid", NFSD will return nfserr_inval, failing the request entirely.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6666 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b , < d8f3f94dc950e7c62c96af432c26745885b0a18a (git)
Affected: 51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b , < 4f76435fd517981f01608678c06ad9718a86ee98 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d8f3f94dc950e7c62c96af432c26745885b0a18a",
              "status": "affected",
              "version": "51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b",
              "versionType": "git"
            },
            {
              "lessThan": "4f76435fd517981f01608678c06ad9718a86ee98",
              "status": "affected",
              "version": "51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Define actions for the new time_deleg FATTR4 attributes\n\nNFSv4 clients won\u0027t send legitimate GETATTR requests for these new\nattributes because they are intended to be used only with CB_GETATTR\nand SETATTR. But NFSD has to do something besides crashing if it\never sees a GETATTR request that queries these attributes.\n\nRFC 8881 Section 18.7.3 states:\n\n\u003e The server MUST return a value for each attribute that the client\n\u003e requests if the attribute is supported by the server for the\n\u003e target file system. If the server does not support a particular\n\u003e attribute on the target file system, then it MUST NOT return the\n\u003e attribute value and MUST NOT set the attribute bit in the result\n\u003e bitmap. The server MUST return an error if it supports an\n\u003e attribute on the target but cannot obtain its value. In that case,\n\u003e no attribute values will be returned.\n\nFurther, RFC 9754 Section 5 states:\n\n\u003e These new attributes are invalid to be used with GETATTR, VERIFY,\n\u003e and NVERIFY, and they can only be used with CB_GETATTR and SETATTR\n\u003e by a client holding an appropriate delegation.\n\nThus there does not appear to be a specific server response mandated\nby specification. Taking the guidance that querying these attributes\nvia GETATTR is \"invalid\", NFSD will return nfserr_inval, failing the\nrequest entirely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the NFSv4 server (nfsd) XDR encoder, reached purely by processing an NFSv4.2 COMPOUND received over TCP port 2049 from a remote client. No local access to the server is required.\nAC:L - The attacker deterministically triggers the NULL function-pointer call by setting bit 84 or 85 in the GETATTR (or READDIR/VERIFY) attribute bitmap; there is no race, no memory-layout dependency, and the config is the default NFSv4.2 server build.\nPR:N - NFS AUTH_SYS/AUTH_NULL verifies no credentials \u2014 the attacker merely issues EXCHANGE_ID/CREATE_SESSION and then PUTROOTFH+GETATTR, with `fh_verify(..., NFSD_MAY_NOP)` performing no permission check, so no authenticated principal is needed against an exported server.\nUI:N - The attacker sends the malformed GETATTR request unilaterally; no action by any administrator or user on the server or on a legitimate client is needed.\nS:U - The crash occurs in the nfsd kernel thread within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The call to the NULL slot faults before any attribute bytes are encoded and the partial reply is discarded via xdr_truncate_encode(), so no kernel memory contents are disclosed.\nI:N - No out-of-bounds write or type confusion occurs; the indirect call to address 0 faults immediately and a remote attacker cannot map page 0 to gain control flow, so no data or code is modified.\nA:H - Dereferencing the NULL function pointer oopses the nfsd service thread (or panics the machine with panic_on_oops), and the unauthenticated request can be replayed to kill every nfsd thread, taking the file server completely offline."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:38.372Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d8f3f94dc950e7c62c96af432c26745885b0a18a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f76435fd517981f01608678c06ad9718a86ee98"
        }
      ],
      "title": "NFSD: Define actions for the new time_deleg FATTR4 attributes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40326",
    "datePublished": "2025-12-08T00:46:53.212Z",
    "dateReserved": "2025-04-16T07:20:57.186Z",
    "dateUpdated": "2026-08-05T12:09:38.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40326",
      "date": "2026-10-16",
      "epss": "0.0035",
      "percentile": "0.27077"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/nfs4xdr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d8f3f94dc950e7c62c96af432c26745885b0a18a",
                    "status": "affected",
                    "version": "51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4f76435fd517981f01608678c06ad9718a86ee98",
                    "status": "affected",
                    "version": "51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/nfs4xdr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Define actions for the new time_deleg FATTR4 attributes\n\nNFSv4 clients won\u0027t send legitimate GETATTR requests for these new\nattributes because they are intended to be used only with CB_GETATTR\nand SETATTR. But NFSD has to do something besides crashing if it\never sees a GETATTR request that queries these attributes.\n\nRFC 8881 Section 18.7.3 states:\n\n\u003e The server MUST return a value for each attribute that the client\n\u003e requests if the attribute is supported by the server for the\n\u003e target file system. If the server does not support a particular\n\u003e attribute on the target file system, then it MUST NOT return the\n\u003e attribute value and MUST NOT set the attribute bit in the result\n\u003e bitmap. The server MUST return an error if it supports an\n\u003e attribute on the target but cannot obtain its value. In that case,\n\u003e no attribute values will be returned.\n\nFurther, RFC 9754 Section 5 states:\n\n\u003e These new attributes are invalid to be used with GETATTR, VERIFY,\n\u003e and NVERIFY, and they can only be used with CB_GETATTR and SETATTR\n\u003e by a client holding an appropriate delegation.\n\nThus there does not appear to be a specific server response mandated\nby specification. Taking the guidance that querying these attributes\nvia GETATTR is \"invalid\", NFSD will return nfserr_inval, failing the\nrequest entirely."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nNFSD: Definir acciones para los nuevos atributos time_deleg FATTR4\n\nLos clientes NFSv4 no enviar\u00e1n solicitudes GETATTR leg\u00edtimas para estos nuevos atributos porque est\u00e1n destinados a ser usados solo con CB_GETATTR y SETATTR. Pero NFSD tiene que hacer algo adem\u00e1s de colapsar si alguna vez ve una solicitud GETATTR que consulta estos atributos.\n\nLa Secci\u00f3n 18.7.3 del RFC 8881 establece:\n\n\u003e El servidor DEBE devolver un valor para cada atributo que el cliente solicita si el atributo es compatible con el servidor para el sistema de archivos de destino. Si el servidor no es compatible con un atributo particular en el sistema de archivos de destino, entonces NO DEBE devolver el valor del atributo y NO DEBE establecer el bit del atributo en el mapa de bits de resultado. El servidor DEBE devolver un error si es compatible con un atributo en el destino pero no puede obtener su valor. En ese caso, no se devolver\u00e1n valores de atributo.\n\nAdem\u00e1s, la Secci\u00f3n 5 del RFC 9754 establece:\n\n\u003e Estos nuevos atributos no son v\u00e1lidos para ser usados con GETATTR, VERIFY y NVERIFY, y solo pueden ser usados con CB_GETATTR y SETATTR por un cliente que posea una delegaci\u00f3n apropiada.\n\nPor lo tanto, no parece haber una respuesta espec\u00edfica del servidor exigida por la especificaci\u00f3n. Tomando la gu\u00eda de que consultar estos atributos a trav\u00e9s de GETATTR es \u0027inv\u00e1lido\u0027, NFSD devolver\u00e1 nfserr_inval, fallando la solicitud por completo."
          }
        ],
        "id": "CVE-2025-40326",
        "lastModified": "2026-10-14T22:10:00.210",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-08T01:16:05.337",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4f76435fd517981f01608678c06ad9718a86ee98"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d8f3f94dc950e7c62c96af432c26745885b0a18a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:43:14+00:00",
      "cve": "CVE-2025-40326",
      "id": "CVE-2025-40326",
      "initial_release_date": "2025-12-08T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: NFSD: Define actions for the new time_deleg FATTR4 attributes",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40326.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.