Skip to main content

Linux Kernel CVE-2025-40210

HIGH
2025-11-21 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Remote unauthenticated COMPOUND header (AV:N/AC:L/PR:N/UI:N) triggers a failed giant allocation causing availability loss only, with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jul 30, 2026 - 08:16 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.5 (HIGH)
Analysis Generated
Mar 28, 2026 - 19:23 vuln.today
CVE Published
Nov 21, 2025 - 11:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"

I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND").

Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in:

[ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0

when NFSD attempts to allocate the COMPOUND op array.

Let's restore the operation-per-COMPOUND limit, but increased to 200 for now.

AnalysisAI

Denial of service in the Linux kernel's NFSD server (NFSv4 subsystem) allows a remote attacker to exhaust memory by specifying an arbitrarily large operation count in an NFSv4 COMPOUND request header, forcing NFSD to attempt a multi-terabyte vmalloc allocation that fails and disrupts service. The flaw was introduced by commit 48aab1606fa8, which removed the historical cap on operations per COMPOUND; the fix restores a limit (raised to 200). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS is very low at 0.03%.

Technical ContextAI

NFSD is the in-kernel Network File System server. In NFSv4, clients batch multiple operations into a single COMPOUND RPC; the server reads the operation count from the COMPOUND header and allocates an array to hold that many op structures before processing. A prior optimization (commit 48aab1606fa8) removed the previous cap on operations-per-COMPOUND, meaning the attacker-supplied count directly drove the allocation size via vmalloc(). The root cause is unbounded, attacker-controlled resource allocation (CWE-770 / CWE-789-class: uncontrolled memory allocation) - the observed log 'vmalloc error: size 1209533382144, exceeds total pages' shows a request for ~1.2 TB. No CWE was assigned in the input. Note: the same regression also caused a pynfs COMP6 test to leave the lease/connection in a bad state (CLOSE9 hang), which motivated the full revert.

Affected ProductsAI

The affected component is the Linux kernel NFSD (NFS server) NFSv4 COMPOUND decoding path. The regression was introduced by commit 48aab1606fa8 ('NFSD: Remove the cap on number of operations per NFSv4 COMPOUND'), so kernels containing that commit up to the fix are vulnerable; exact version boundaries are not enumerated in the provided data (no NVD CPE ranges were supplied). Fix commits are published on the kernel stable tree at https://git.kernel.org/stable/c/3e7f011c255582d7c914133785bbba1990441713 and https://git.kernel.org/stable/c/b3ee7ce432289deac87b9d14e01f2fe6958f7f0b, with a third-party advisory at https://vuldb.com/vuln/333201.

RemediationAI

Upstream fix available (commit/stable-tree patch); a specific released kernel package version is not independently confirmed in the provided data - apply the distribution kernel update that incorporates the stable commits 3e7f011c255582d7c914133785bbba1990441713 or b3ee7ce432289deac87b9d14e01f2fe6958f7f0b, which restore the per-COMPOUND operation cap (set to 200). If you cannot patch immediately, reduce exposure by restricting NFSv4 access at the network layer - firewall TCP/2049 to trusted client subnets only, or place NFS behind a VPN/private network - since the trade-off is that any legitimate remote NFS clients outside that boundary lose access. Where NFSv4 is not required, disabling the NFS server (or limiting to NFSv3) removes the affected code path but breaks NFSv4 clients. Consult the kernel stable commits above and the vendor kernel advisory for the exact patched build for your distribution.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2025-40210 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy