CVE-2025-40210
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-11-21

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"). Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in: [ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 when NFSD attempts to allocate the COMPOUND op array. Let's restore the operation-per-COMPOUND limit, but increased to 200 for now.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-21
Last Modified
2025-11-21
Generated
2026-05-07
AI Q&A
2025-11-21
EPSS Evaluated
2026-05-05
NVD
CVE-2025-40210
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability involves the Linux kernel's NFS server (NFSD) handling of NFSv4 COMPOUND operations. Specifically, an attacker can craft a COMPOUND request with an arbitrarily large number of operations in its header. This causes the NFSD to attempt to allocate an excessively large amount of memory for the operations array, leading to a vmalloc error due to exceeding available memory. The issue arose after removing the cap on the number of operations per NFSv4 COMPOUND, which has now been restored with an increased limit of 200 operations.


How can this vulnerability impact me? :

This vulnerability can cause the NFS server to attempt to allocate an extremely large amount of memory, potentially leading to resource exhaustion or denial of service (DoS) conditions. Additionally, it can cause certain NFS operations, such as CLOSE9, to hang indefinitely, disrupting normal NFS functionality and potentially impacting system stability and availability.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability is mitigated by restoring the operation-per-COMPOUND limit in the Linux kernel, increased to 200. Therefore, immediate steps include updating your Linux kernel to a version that includes this fix to prevent an attacker from causing excessive memory allocation by placing an arbitrarily large operation count in the NFSv4 COMPOUND header.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart