CVE-2025-40212

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40212", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.179Z", "datePublished": "2025-11-24T13:04:20.888Z", "dateUpdated": "2026-08-05T12:08:37.417Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:37.417Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix refcount leak in nfsd_set_fh_dentry()\n\nnfsd exports a \"pseudo root filesystem\" which is used by NFSv4 to find\nthe various exported filesystems using LOOKUP requests from a known root\nfilehandle. NFSv3 uses the MOUNT protocol to find those exported\nfilesystems and so is not given access to the pseudo root filesystem.\n\nIf a v3 (or v2) client uses a filehandle from that filesystem,\nnfsd_set_fh_dentry() will report an error, but still stores the export\nin \"struct svc_fh\" even though it also drops the reference (exp_put()).\nThis means that when fh_put() is called an extra reference will be dropped\nwhich can lead to use-after-free and possible denial of service.\n\nNormal NFS usage will not provide a pseudo-root filehandle to a v3\nclient. This bug can only be triggered by the client synthesising an\nincorrect filehandle.\n\nTo fix this we move the assignments to the svc_fh later, after all\npossible error cases have been detected."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is in the in-kernel NFS server (nfsd) and is triggered by a crafted filehandle sent by a remote NFSv3/v2 client over the network (TCP/UDP port 2049).\nAC:L - The attacker fully controls the synthesized filehandle and triggers the double exp_put deterministically with a single request; the required V4ROOT pseudo-root export exists by default whenever NFSv4 is enabled, and no race is involved.\nPR:N - NFS clients are unauthenticated at the network level (AUTH_SYS/AUTH_NULL merely assert an identity), and the bug requires no OS privileges on the server \u2014 a malicious client simply synthesizes an invalid pseudo-root filehandle.\nUI:N - Exploitation requires only that the attacker send a crafted NFSv3 request; no action by any local user or administrator is needed.\nS:U - The use-after-free is confined to the kernel's own memory/security authority with no crossing of a trust boundary such as a VM or IOMMU.\nC:H - The over-released svc_export becomes a use-after-free object; per UAF scoring the attacker can gain control over freed/reallocated memory contents, enabling arbitrary kernel information disclosure.\nI:H - A use-after-free of a heap object (svc_export) enables heap grooming and write primitives against the reallocated memory, supporting kernel integrity compromise and control-flow hijacking.\nA:H - The premature free of an in-use svc_export reliably causes use-after-free crashes/oops, and repeated requests can drive the refcount underflow to panic the server."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfsfh.c"], "versions": [{"version": "ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444", "lessThan": "b6bc86ce3944b10b9fc181fc00c1a520a20ed965", "status": "affected", "versionType": "git"}, {"version": "ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444", "lessThan": "c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2", "status": "affected", "versionType": "git"}, {"version": "ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444", "lessThan": "8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfsfh.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.59", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.9", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.17.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b6bc86ce3944b10b9fc181fc00c1a520a20ed965"}, {"url": "https://git.kernel.org/stable/c/c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2"}, {"url": "https://git.kernel.org/stable/c/8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c"}], "title": "nfsd: fix refcount leak in nfsd_set_fh_dentry()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/nfsfh.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b6bc86ce3944b10b9fc181fc00c1a520a20ed965", "status": "affected", "version": "ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444", "versionType": "git"}, {"lessThan": "c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2", "status": "affected", "version": "ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444", "versionType": "git"}, {"lessThan": "8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c", "status": "affected", "version": "ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/nfsfh.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.59", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix refcount leak in nfsd_set_fh_dentry()\n\nnfsd exports a \"pseudo root filesystem\" which is used by NFSv4 to find\nthe various exported filesystems using LOOKUP requests from a known root\nfilehandle. NFSv3 uses the MOUNT protocol to find those exported\nfilesystems and so is not given access to the pseudo root filesystem.\n\nIf a v3 (or v2) client uses a filehandle from that filesystem,\nnfsd_set_fh_dentry() will report an error, but still stores the export\nin \"struct svc_fh\" even though it also drops the reference (exp_put()).\nThis means that when fh_put() is called an extra reference will be dropped\nwhich can lead to use-after-free and possible denial of service.\n\nNormal NFS usage will not provide a pseudo-root filehandle to a v3\nclient. This bug can only be triggered by the client synthesising an\nincorrect filehandle.\n\nTo fix this we move the assignments to the svc_fh later, after all\npossible error cases have been detected."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnfsd: corregir fuga de contador de referencias en nfsd_set_fh_dentry()\n\nnfsd exporta un 'pseudo sistema de archivos ra\u00edz' que es utilizado por NFSv4 para encontrar los diversos sistemas de archivos exportados usando solicitudes LOOKUP desde un filehandle ra\u00edz conocido. NFSv3 utiliza el protocolo MOUNT para encontrar esos sistemas de archivos exportados y por lo tanto no se le da acceso al pseudo sistema de archivos ra\u00edz.\n\nSi un cliente v3 (o v2) utiliza un filehandle de ese sistema de archivos, nfsd_set_fh_dentry() reportar\u00e1 un error, pero a\u00fan almacena la exportaci\u00f3n en 'struct svc_fh' a pesar de que tambi\u00e9n libera la referencia (exp_put()). Esto significa que cuando se llama a fh_put(), se liberar\u00e1 una referencia adicional, lo que puede llevar a uso despu\u00e9s de liberaci\u00f3n y posible denegaci\u00f3n de servicio.\n\nEl uso normal de NFS no proporcionar\u00e1 un filehandle pseudo-ra\u00edz a un cliente v3. Este error solo puede ser desencadenado por el cliente sintetizando un filehandle incorrecto.\n\nPara corregir esto, movemos las asignaciones al svc_fh m\u00e1s tarde, despu\u00e9s de que se hayan detectado todos los posibles casos de error."}], "id": "CVE-2025-40212", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-11-24T13:16:02.813", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b6bc86ce3944b10b9fc181fc00c1a520a20ed965"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: nfsd: fix refcount leak in nfsd_set_fh_dentry()", "id": "2416750", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2416750"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40212", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40212\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40212\nhttps://lore.kernel.org/linux-cve-announce/2025112424-CVE-2025-40212-e33b@gregkh/T"], "threat_severity": "Important"}

{}