Skip to main content

Linux Kernel CVE-2025-40212

CRITICAL
2025-11-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable NFS with no auth (PR:N), but requires forging a specific pseudo-root filehandle and winning a UAF race (AC:H); realistic impact is server crash only (A:H, C/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.3 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jul 30, 2026 - 06:50 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
9.8 (CRITICAL)
Analysis Generated
Mar 28, 2026 - 19:23 vuln.today
CVE Published
Nov 24, 2025 - 13:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix refcount leak in nfsd_set_fh_dentry()

nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem.

If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry() will report an error, but still stores the export in "struct svc_fh" even though it also drops the reference (exp_put()). This means that when fh_put() is called an extra reference will be dropped which can lead to use-after-free and possible denial of service.

Normal NFS usage will not provide a pseudo-root filehandle to a v3 client. This bug can only be triggered by the client synthesising an incorrect filehandle.

To fix this we move the assignments to the svc_fh later, after all possible error cases have been detected.

AnalysisAI

Denial of service (and potential use-after-free) in the Linux kernel's NFS server (nfsd) allows a malicious NFSv2/NFSv3 client to trigger a refcount leak in nfsd_set_fh_dentry() by presenting a synthesized pseudo-root filehandle. Because nfsd stores the export in struct svc_fh even after dropping its reference via exp_put(), a later fh_put() drops an extra reference, leading to use-after-free and possible crash of the NFS server. EPSS is low (0.07%, 21st percentile) and there is no public exploit identified at time of analysis; despite the input's 9.8 CVSS, the description limits real impact to DoS reachable only by a client that deliberately forges an invalid filehandle.

Technical ContextAI

nfsd exports a 'pseudo root filesystem' that NFSv4 clients traverse via LOOKUP from a known root filehandle; NFSv2/NFSv3 clients instead use the MOUNT protocol and are not meant to touch the pseudo root. The bug lives in filehandle-to-dentry resolution (nfsd_set_fh_dentry): when a v2/v3 client references the pseudo-root filesystem, the function reports an error and calls exp_put() to release the export reference, but still assigns the export pointer into struct svc_fh. The subsequent fh_put() then decrements the same refcount a second time. This is a classic reference-count mismanagement / use-after-free (CWE-416/CWE-911 class) caused by mutating shared state before all error paths are validated; the fix reorders the svc_fh assignments to occur only after every error case is handled. CWE was not supplied in the feed (CWE: N/A), but the root cause is an over-release of an object reference.

Affected ProductsAI

The vulnerability affects the Linux kernel's in-kernel NFS server (nfsd) subsystem. Specific fixed/affected version boundaries are not enumerated in the provided feed (no CPE strings were supplied and CVSS/NVD did not include version ranges), but the fix landed in the stable tree via commits referenced at https://git.kernel.org/stable/c/8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c, https://git.kernel.org/stable/c/b6bc86ce3944b10b9fc181fc00c1a520a20ed965, and https://git.kernel.org/stable/c/c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2. Only systems that actually run the kernel NFS server (nfsd) and export filesystems are exposed; kernels without nfsd loaded/enabled are not affected in practice.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the stable-tree fix from the three git.kernel.org commits (8a7348a9ed70, b6bc86ce3944, c83d7365cec5) by updating to a distribution kernel that incorporates them, or rebuild from a patched stable branch. Consult your distribution's security tracker for the exact packaged kernel version once available, since the feed did not provide a tagged release number. As a compensating control until patched, restrict which hosts can reach the NFS server: firewall NFS ports (TCP/UDP 2049, plus rpcbind/mountd ports) to only trusted client subnets, and export filesystems only to known clients via /etc/exports host restrictions - trade-off is reduced NFS reachability for legitimate ad-hoc clients. Where NFSv4 is the only required protocol, disabling NFSv2/NFSv3 (e.g., limiting nfsd to vers=4) removes the specific v2/v3 trigger path, at the cost of breaking any remaining v3 clients. If the NFS server is not needed on a given host, unload/disable nfsd entirely.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:latest Affected
Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:latest Affected

Share

CVE-2025-40212 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy