Skip to main content

Linux Kernel CVE-2025-40324

| EUVDEUVD-2025-201621 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Red Hat Suse
7.5
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable NFS READ triggers it, but the crash only occurs when the non-default NFSD tracepoint is enabled, so AC:H; availability-only, no C/I impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.5 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201621
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.5
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Fix crash in nfsd4_read_release()

When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test.

AnalysisAI

Denial of service in the Linux kernel NFS server (nfsd) allows a crash in nfsd4_read_release() to be triggered while the trace_nfsd_read_done tracepoint is active, as surfaced by the pynfs read.testNoFh conformance test. The flaw affects NFSv4 READ compound processing and results in a kernel crash (availability impact only, no data disclosure or code execution). It has been resolved upstream and shipped across multiple stable series; no public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.05%).

Technical ContextAI

The bug lives in the kernel's NFSv4 server (fs/nfsd), specifically in nfsd4_read_release(), the cleanup handler for a decoded NFSv4 READ operation within a COMPOUND request. The static tracepoint trace_nfsd_read_done dereferences READ-operation state during teardown; a lifetime/ordering defect in that release path causes a bad access (a use-after-free or NULL/stale pointer dereference class of bug) when the tracepoint is enabled and fires. CWE is not assigned in the input, but the observable behavior - an oops during release while tracing dereferences operation state - is consistent with a use-after-free / invalid-pointer-dereference in the NFSD read teardown logic. No CPE strings were provided; affected components are identified by kernel git commit hashes and stable-tree version tags rather than CPE.

RemediationAI

Vendor-released patch: update to a fixed kernel - 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, or 6.18 (or your distribution's equivalent) as listed in the EUVD advisory. Ubuntu users should apply the kernels shipped in USN-8095-1 (https://ubuntu.com/security/notices/USN-8095-1) and USN-8096-1 (https://ubuntu.com/security/notices/USN-8096-1) and reboot. As an interim compensating control until reboot, disable the offending NFSD tracepoint (e.g. ensure trace_nfsd_read_done / nfsd read tracing is not enabled via /sys/kernel/debug/tracing) since the crash is only triggered while that tracepoint is active - the trade-off is loss of NFSD read tracing for debugging. Where feasible, also restrict NFS server exposure to trusted networks/clients to reduce who can drive READ traffic. Corresponding upstream fix commits are available on git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/03524ccff698d4a77d096ed529073d91f5edee5d).

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40324 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy