CVE-2025-40212
BaseFortify
Publication date: 2025-11-24
Last updated on: 2025-11-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a refcount leak in the Linux kernel's nfsd component, specifically in the function nfsd_set_fh_dentry(). The nfsd exports a pseudo root filesystem used by NFSv4 clients to locate exported filesystems. NFSv3 clients do not have access to this pseudo root filesystem. However, if a v3 or v2 client uses a filehandle from the pseudo root filesystem, the function reports an error but still stores the export in a structure, leading to an extra reference being dropped later. This can cause a use-after-free condition and potentially a denial of service. The bug can only be triggered by a client synthesizing an incorrect filehandle, and normal NFS usage does not expose this issue. The fix involved moving assignments to occur only after all error cases are checked.
How can this vulnerability impact me? :
This vulnerability can lead to a use-after-free condition in the Linux kernel's nfsd service, which may cause a denial of service (DoS). An attacker who crafts an incorrect filehandle could exploit this to crash the nfsd service or cause instability, potentially disrupting access to NFS-exported filesystems.