CVE-2025-40210 (GCVE-0-2025-40210)

Vulnerability from cvelistv5 – Published: 2025-11-21 10:21 – Updated: 2026-08-05 12:08
VLAI
Title
Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"
Summary
In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"). Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in: [ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 when NFSD attempts to allocate the COMPOUND op array. Let's restore the operation-per-COMPOUND limit, but increased to 200 for now.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 7061 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 48aab1606fa80027143a445224f552b4eeea845b , < b3ee7ce432289deac87b9d14e01f2fe6958f7f0b (git)
Affected: 48aab1606fa80027143a445224f552b4eeea845b , < 3e7f011c255582d7c914133785bbba1990441713 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/nfs4xdr.c",
            "fs/nfsd/nfsd.h",
            "fs/nfsd/xdr4.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3ee7ce432289deac87b9d14e01f2fe6958f7f0b",
              "status": "affected",
              "version": "48aab1606fa80027143a445224f552b4eeea845b",
              "versionType": "git"
            },
            {
              "lessThan": "3e7f011c255582d7c914133785bbba1990441713",
              "status": "affected",
              "version": "48aab1606fa80027143a445224f552b4eeea845b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/nfs4xdr.c",
            "fs/nfsd/nfsd.h",
            "fs/nfsd/xdr4.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"\n\nI\u0027ve found that pynfs COMP6 now leaves the connection or lease in a\nstrange state, which causes CLOSE9 to hang indefinitely. I\u0027ve dug\ninto it a little, but I haven\u0027t been able to root-cause it yet.\nHowever, I bisected to commit 48aab1606fa8 (\"NFSD: Remove the cap on\nnumber of operations per NFSv4 COMPOUND\").\n\nTianshuo Han also reports a potential vulnerability when decoding\nan NFSv4 COMPOUND. An attacker can place an arbitrarily large op\ncount in the COMPOUND header, which results in:\n\n[   51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total\npages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO),\nnodemask=(null),cpuset=/,mems_allowed=0\n\nwhen NFSD attempts to allocate the COMPOUND op array.\n\nLet\u0027s restore the operation-per-COMPOUND limit, but increased to 200\nfor now."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the NFSv4 COMPOUND XDR decoder in the in-kernel NFS server, driven directly by bytes received on TCP/UDP port 2049 from a remote client. No local access is needed.\nAC:L - A single malformed COMPOUND header with a large 32-bit op count deterministically triggers the unbounded vcalloc; the attacker fully controls the requested size and can tune it to either fail loudly or succeed and pin gigabytes.\nPR:N - The allocation occurs during XDR decode, before any export, filehandle, or file-permission check, and the only gate is `svc_set_client`\u0027s IP-based export ACL \u2014 not a user credential. Under the standard AUTH_SYS flavor no secret or account on the server is required.\nUI:N - The attacker only needs to send an RPC to the listening nfsd port; no action by any local user or administrator is involved.\nS:U - The impact is confined to the NFS server kernel\u0027s own memory and scheduling resources, with no crossing into another security authority such as a hypervisor or IOMMU boundary.\nC:N - `size_mul()` saturates instead of wrapping, so the array is never undersized; there is no out-of-bounds read, no uninitialized memory exposure, and nothing is returned to the attacker beyond a garbage-args RPC error.\nI:N - No attacker-controlled data is written outside the correctly sized allocation and no filesystem or kernel state is modified \u2014 the request is rejected once decode fails.\nA:H - An unauthenticated remote client can force arbitrarily large `GFP_KERNEL|__GFP_ZERO` vmalloc requests, exhausting kernel memory and triggering OOM kills, reclaim stalls and allocation-failure splats across all nfsd threads; the same regression also produces the reported indefinite CLOSE hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:36.344Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3ee7ce432289deac87b9d14e01f2fe6958f7f0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e7f011c255582d7c914133785bbba1990441713"
        }
      ],
      "title": "Revert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40210",
    "datePublished": "2025-11-21T10:21:35.540Z",
    "dateReserved": "2025-04-16T07:20:57.179Z",
    "dateUpdated": "2026-08-05T12:08:36.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40210",
      "date": "2026-10-23",
      "epss": "0.00358",
      "percentile": "0.28381"
    },
    "microsoft_vex": {
      "current_release_date": "2025-11-25T01:39:58.000Z",
      "cve": "CVE-2025-40210",
      "id": "msrc_CVE-2025-40210",
      "initial_release_date": "2025-11-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Revert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40210.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/nfs4proc.c",
                  "fs/nfsd/nfs4state.c",
                  "fs/nfsd/nfs4xdr.c",
                  "fs/nfsd/nfsd.h",
                  "fs/nfsd/xdr4.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b3ee7ce432289deac87b9d14e01f2fe6958f7f0b",
                    "status": "affected",
                    "version": "48aab1606fa80027143a445224f552b4eeea845b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3e7f011c255582d7c914133785bbba1990441713",
                    "status": "affected",
                    "version": "48aab1606fa80027143a445224f552b4eeea845b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/nfsd/nfs4proc.c",
                  "fs/nfsd/nfs4state.c",
                  "fs/nfsd/nfs4xdr.c",
                  "fs/nfsd/nfsd.h",
                  "fs/nfsd/xdr4.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"\n\nI\u0027ve found that pynfs COMP6 now leaves the connection or lease in a\nstrange state, which causes CLOSE9 to hang indefinitely. I\u0027ve dug\ninto it a little, but I haven\u0027t been able to root-cause it yet.\nHowever, I bisected to commit 48aab1606fa8 (\"NFSD: Remove the cap on\nnumber of operations per NFSv4 COMPOUND\").\n\nTianshuo Han also reports a potential vulnerability when decoding\nan NFSv4 COMPOUND. An attacker can place an arbitrarily large op\ncount in the COMPOUND header, which results in:\n\n[   51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total\npages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO),\nnodemask=(null),cpuset=/,mems_allowed=0\n\nwhen NFSD attempts to allocate the COMPOUND op array.\n\nLet\u0027s restore the operation-per-COMPOUND limit, but increased to 200\nfor now."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRevertir \u0027NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\u0027\n\nHe descubierto que pynfs COMP6 ahora deja la conexi\u00f3n o el arrendamiento en un estado extra\u00f1o, lo que provoca que CLOSE9 se cuelgue indefinidamente. He investigado un poco, pero a\u00fan no he podido determinar la causa ra\u00edz. Sin embargo, hice una b\u00fasqueda binaria hasta el commit 48aab1606fa8 (\u0027NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\u0027).\n\nTianshuo Han tambi\u00e9n informa una posible vulnerabilidad al decodificar un COMPOUND NFSv4. Un atacante puede colocar un recuento de operaciones arbitrariamente grande en la cabecera del COMPOUND, lo que resulta en:\n\n[ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0\n\ncuando NFSD intenta asignar el array de operaciones del COMPOUND.\n\nRestauremos el l\u00edmite de operaciones por COMPOUND, pero aumentado a 200 por ahora."
          }
        ],
        "id": "CVE-2025-40210",
        "lastModified": "2026-10-19T19:10:00.130",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-11-21T11:15:49.110",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3e7f011c255582d7c914133785bbba1990441713"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b3ee7ce432289deac87b9d14e01f2fe6958f7f0b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:48:01+00:00",
      "cve": "CVE-2025-40210",
      "id": "CVE-2025-40210",
      "initial_release_date": "2025-11-21T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_affected": "25",
      "product_status:known_not_affected": "173",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Revert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40210.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.