CVE-2025-40210 (GCVE-0-2025-40210)
Vulnerability from cvelistv5
Published
2025-11-21 10:21
Modified
2026-08-05 12:08
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"). Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in: [ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 when NFSD attempts to allocate the COMPOUND op array. Let's restore the operation-per-COMPOUND limit, but increased to 200 for now.
References
Impacted products
Vendor Product Version
Linux Linux Version: 48aab1606fa80027143a445224f552b4eeea845b
Version: 48aab1606fa80027143a445224f552b4eeea845b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/nfs4xdr.c",
            "fs/nfsd/nfsd.h",
            "fs/nfsd/xdr4.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b3ee7ce432289deac87b9d14e01f2fe6958f7f0b",
              "status": "affected",
              "version": "48aab1606fa80027143a445224f552b4eeea845b",
              "versionType": "git"
            },
            {
              "lessThan": "3e7f011c255582d7c914133785bbba1990441713",
              "status": "affected",
              "version": "48aab1606fa80027143a445224f552b4eeea845b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4state.c",
            "fs/nfsd/nfs4xdr.c",
            "fs/nfsd/nfsd.h",
            "fs/nfsd/xdr4.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"\n\nI\u0027ve found that pynfs COMP6 now leaves the connection or lease in a\nstrange state, which causes CLOSE9 to hang indefinitely. I\u0027ve dug\ninto it a little, but I haven\u0027t been able to root-cause it yet.\nHowever, I bisected to commit 48aab1606fa8 (\"NFSD: Remove the cap on\nnumber of operations per NFSv4 COMPOUND\").\n\nTianshuo Han also reports a potential vulnerability when decoding\nan NFSv4 COMPOUND. An attacker can place an arbitrarily large op\ncount in the COMPOUND header, which results in:\n\n[   51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total\npages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO),\nnodemask=(null),cpuset=/,mems_allowed=0\n\nwhen NFSD attempts to allocate the COMPOUND op array.\n\nLet\u0027s restore the operation-per-COMPOUND limit, but increased to 200\nfor now."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the NFSv4 COMPOUND XDR decoder in the in-kernel NFS server, driven directly by bytes received on TCP/UDP port 2049 from a remote client. No local access is needed.\nAC:L - A single malformed COMPOUND header with a large 32-bit op count deterministically triggers the unbounded vcalloc; the attacker fully controls the requested size and can tune it to either fail loudly or succeed and pin gigabytes.\nPR:N - The allocation occurs during XDR decode, before any export, filehandle, or file-permission check, and the only gate is `svc_set_client`\u0027s IP-based export ACL \u2014 not a user credential. Under the standard AUTH_SYS flavor no secret or account on the server is required.\nUI:N - The attacker only needs to send an RPC to the listening nfsd port; no action by any local user or administrator is involved.\nS:U - The impact is confined to the NFS server kernel\u0027s own memory and scheduling resources, with no crossing into another security authority such as a hypervisor or IOMMU boundary.\nC:N - `size_mul()` saturates instead of wrapping, so the array is never undersized; there is no out-of-bounds read, no uninitialized memory exposure, and nothing is returned to the attacker beyond a garbage-args RPC error.\nI:N - No attacker-controlled data is written outside the correctly sized allocation and no filesystem or kernel state is modified \u2014 the request is rejected once decode fails.\nA:H - An unauthenticated remote client can force arbitrarily large `GFP_KERNEL|__GFP_ZERO` vmalloc requests, exhausting kernel memory and triggering OOM kills, reclaim stalls and allocation-failure splats across all nfsd threads; the same regression also produces the reported indefinite CLOSE hang."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:36.344Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b3ee7ce432289deac87b9d14e01f2fe6958f7f0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e7f011c255582d7c914133785bbba1990441713"
        }
      ],
      "title": "Revert \"NFSD: Remove the cap on number of operations per NFSv4 COMPOUND\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40210",
    "datePublished": "2025-11-21T10:21:35.540Z",
    "dateReserved": "2025-04-16T07:20:57.179Z",
    "dateUpdated": "2026-08-05T12:08:36.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.