Skip to main content

Linux Kernel CVE-2025-40087

HIGH
2025-10-30 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-reachable LAYOUTCOMMIT crashes the server with no auth modeled (PR:N) and low complexity (AC:L); impact is availability-only (A:H), so C:N/I:N, matching the DoS description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:43 vuln.today
CVE Published
Oct 30, 2025 - 10:15 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Define a proc_layoutcommit for the FlexFiles layout type

Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT operation on a FlexFiles layout.

AnalysisAI

Denial of service in the Linux kernel's NFS server (NFSD) allows a pNFS client to crash the host by sending a LAYOUTCOMMIT operation against a FlexFiles-type layout, for which NFSD previously defined no proc_layoutcommit handler. Any system exporting files over pNFS with the FlexFiles layout driver is affected until patched. This is a stability/availability bug (no confirmed data compromise); no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.20% (10th percentile).

Technical ContextAI

The affected component is NFSD, the in-kernel NFS server, specifically its parallel NFS (pNFS) metadata-server support. pNFS lets clients receive a 'layout' describing where file data lives and later commit changes with a LAYOUTCOMMIT operation. NFSD supports multiple layout types (e.g. Block, SCSI, FlexFiles); the FlexFiles driver lacked a proc_layoutcommit callback, so an incoming LAYOUTCOMMIT for that layout type dereferenced a missing/NULL operation handler. No CWE was assigned in the feed, but the root cause is consistent with a NULL-pointer dereference / missing case handler (CWE-476-class) reachable through an unhandled protocol operation - this is inferred from the description, not vendor-confirmed. The fix defines a proper proc_layoutcommit for the FlexFiles layout type so the operation is handled gracefully.

Affected ProductsAI

The Linux kernel is affected wherever NFSD's pNFS support is built and configured to serve the FlexFiles layout type. The intelligence feed provides no CPE strings and no explicit version ranges; affected/fixed versions can only be inferred from the eight stable-tree commit references on git.kernel.org (e.g. 34d187e020cbda112a6c6f094f0ca5e6a8672b75, 4b47a8601b71ad98833b447d465592d847b4dc77, 785ec512afa80d0540f2ca797c0e56de747a6083, and five additional backport commits), which indicate the fix was applied across multiple stable branches. No distribution vendor advisory URL was supplied in the references, so exact per-distro fixed package versions should be confirmed against your distribution's security tracker.

RemediationAI

Upstream fix available (commit); released patched version not independently confirmed - apply the kernel update that incorporates the referenced stable commits (e.g. git.kernel.org/stable/c/34d187e020cbda112a6c6f094f0ca5e6a8672b75 and the seven sibling backports) via your distribution's patched kernel package, then reboot. Because no tagged release version or vendor advisory URL is present in the feed, verify the specific fixed package build in your distribution's security tracker before scheduling. As a compensating control until patched, avoid exporting the FlexFiles layout type from NFSD or disable pNFS layout serving so LAYOUTCOMMIT for FlexFiles is never processed; where feasible, restrict NFS/pNFS access to trusted client networks via firewall rules to limit who can send the triggering operation. Trade-off: disabling pNFS/FlexFiles removes the parallel-I/O performance benefit for legitimate clients, and network restrictions may break access for remote or roaming NFS clients.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.6.17.8.134 Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.65 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.88 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.105 Affected

Share

CVE-2025-40087 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy