FKIE_CVE-2025-40326

Vulnerability from fkie_nvd - Published: 2025-12-08 01:16 - Updated: 2026-10-14 22:10
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: NFSD: Define actions for the new time_deleg FATTR4 attributes NFSv4 clients won't send legitimate GETATTR requests for these new attributes because they are intended to be used only with CB_GETATTR and SETATTR. But NFSD has to do something besides crashing if it ever sees a GETATTR request that queries these attributes. RFC 8881 Section 18.7.3 states: > The server MUST return a value for each attribute that the client > requests if the attribute is supported by the server for the > target file system. If the server does not support a particular > attribute on the target file system, then it MUST NOT return the > attribute value and MUST NOT set the attribute bit in the result > bitmap. The server MUST return an error if it supports an > attribute on the target but cannot obtain its value. In that case, > no attribute values will be returned. Further, RFC 9754 Section 5 states: > These new attributes are invalid to be used with GETATTR, VERIFY, > and NVERIFY, and they can only be used with CB_GETATTR and SETATTR > by a client holding an appropriate delegation. Thus there does not appear to be a specific server response mandated by specification. Taking the guidance that querying these attributes via GETATTR is "invalid", NFSD will return nfserr_inval, failing the request entirely.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4f76435fd517981f01608678c06ad9718a86ee98
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d8f3f94dc950e7c62c96af432c26745885b0a18a
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d8f3f94dc950e7c62c96af432c26745885b0a18a",
              "status": "affected",
              "version": "51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b",
              "versionType": "git"
            },
            {
              "lessThan": "4f76435fd517981f01608678c06ad9718a86ee98",
              "status": "affected",
              "version": "51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Define actions for the new time_deleg FATTR4 attributes\n\nNFSv4 clients won\u0027t send legitimate GETATTR requests for these new\nattributes because they are intended to be used only with CB_GETATTR\nand SETATTR. But NFSD has to do something besides crashing if it\never sees a GETATTR request that queries these attributes.\n\nRFC 8881 Section 18.7.3 states:\n\n\u003e The server MUST return a value for each attribute that the client\n\u003e requests if the attribute is supported by the server for the\n\u003e target file system. If the server does not support a particular\n\u003e attribute on the target file system, then it MUST NOT return the\n\u003e attribute value and MUST NOT set the attribute bit in the result\n\u003e bitmap. The server MUST return an error if it supports an\n\u003e attribute on the target but cannot obtain its value. In that case,\n\u003e no attribute values will be returned.\n\nFurther, RFC 9754 Section 5 states:\n\n\u003e These new attributes are invalid to be used with GETATTR, VERIFY,\n\u003e and NVERIFY, and they can only be used with CB_GETATTR and SETATTR\n\u003e by a client holding an appropriate delegation.\n\nThus there does not appear to be a specific server response mandated\nby specification. Taking the guidance that querying these attributes\nvia GETATTR is \"invalid\", NFSD will return nfserr_inval, failing the\nrequest entirely."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nNFSD: Definir acciones para los nuevos atributos time_deleg FATTR4\n\nLos clientes NFSv4 no enviar\u00e1n solicitudes GETATTR leg\u00edtimas para estos nuevos atributos porque est\u00e1n destinados a ser usados solo con CB_GETATTR y SETATTR. Pero NFSD tiene que hacer algo adem\u00e1s de colapsar si alguna vez ve una solicitud GETATTR que consulta estos atributos.\n\nLa Secci\u00f3n 18.7.3 del RFC 8881 establece:\n\n\u003e El servidor DEBE devolver un valor para cada atributo que el cliente solicita si el atributo es compatible con el servidor para el sistema de archivos de destino. Si el servidor no es compatible con un atributo particular en el sistema de archivos de destino, entonces NO DEBE devolver el valor del atributo y NO DEBE establecer el bit del atributo en el mapa de bits de resultado. El servidor DEBE devolver un error si es compatible con un atributo en el destino pero no puede obtener su valor. En ese caso, no se devolver\u00e1n valores de atributo.\n\nAdem\u00e1s, la Secci\u00f3n 5 del RFC 9754 establece:\n\n\u003e Estos nuevos atributos no son v\u00e1lidos para ser usados con GETATTR, VERIFY y NVERIFY, y solo pueden ser usados con CB_GETATTR y SETATTR por un cliente que posea una delegaci\u00f3n apropiada.\n\nPor lo tanto, no parece haber una respuesta espec\u00edfica del servidor exigida por la especificaci\u00f3n. Tomando la gu\u00eda de que consultar estos atributos a trav\u00e9s de GETATTR es \u0027inv\u00e1lido\u0027, NFSD devolver\u00e1 nfserr_inval, fallando la solicitud por completo."
    }
  ],
  "id": "CVE-2025-40326",
  "lastModified": "2026-10-14T22:10:00.210",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-08T01:16:05.337",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4f76435fd517981f01608678c06ad9718a86ee98"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d8f3f94dc950e7c62c96af432c26745885b0a18a"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.