CVE-2025-40326

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40326", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.186Z", "datePublished": "2025-12-08T00:46:53.212Z", "dateUpdated": "2026-08-05T12:09:38.372Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:38.372Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Define actions for the new time_deleg FATTR4 attributes\n\nNFSv4 clients won't send legitimate GETATTR requests for these new\nattributes because they are intended to be used only with CB_GETATTR\nand SETATTR. But NFSD has to do something besides crashing if it\never sees a GETATTR request that queries these attributes.\n\nRFC 8881 Section 18.7.3 states:\n\n> The server MUST return a value for each attribute that the client\n> requests if the attribute is supported by the server for the\n> target file system. If the server does not support a particular\n> attribute on the target file system, then it MUST NOT return the\n> attribute value and MUST NOT set the attribute bit in the result\n> bitmap. The server MUST return an error if it supports an\n> attribute on the target but cannot obtain its value. In that case,\n> no attribute values will be returned.\n\nFurther, RFC 9754 Section 5 states:\n\n> These new attributes are invalid to be used with GETATTR, VERIFY,\n> and NVERIFY, and they can only be used with CB_GETATTR and SETATTR\n> by a client holding an appropriate delegation.\n\nThus there does not appear to be a specific server response mandated\nby specification. Taking the guidance that querying these attributes\nvia GETATTR is \"invalid\", NFSD will return nfserr_inval, failing the\nrequest entirely."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is the NFSv4 server (nfsd) XDR encoder, reached purely by processing an NFSv4.2 COMPOUND received over TCP port 2049 from a remote client. No local access to the server is required.\nAC:L - The attacker deterministically triggers the NULL function-pointer call by setting bit 84 or 85 in the GETATTR (or READDIR/VERIFY) attribute bitmap; there is no race, no memory-layout dependency, and the config is the default NFSv4.2 server build.\nPR:N - NFS AUTH_SYS/AUTH_NULL verifies no credentials \u2014 the attacker merely issues EXCHANGE_ID/CREATE_SESSION and then PUTROOTFH+GETATTR, with `fh_verify(..., NFSD_MAY_NOP)` performing no permission check, so no authenticated principal is needed against an exported server.\nUI:N - The attacker sends the malformed GETATTR request unilaterally; no action by any administrator or user on the server or on a legitimate client is needed.\nS:U - The crash occurs in the nfsd kernel thread within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The call to the NULL slot faults before any attribute bytes are encoded and the partial reply is discarded via xdr_truncate_encode(), so no kernel memory contents are disclosed.\nI:N - No out-of-bounds write or type confusion occurs; the indirect call to address 0 faults immediately and a remote attacker cannot map page 0 to gain control flow, so no data or code is modified.\nA:H - Dereferencing the NULL function pointer oopses the nfsd service thread (or panics the machine with panic_on_oops), and the unauthenticated request can be replayed to kill every nfsd thread, taking the file server completely offline."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4xdr.c"], "versions": [{"version": "51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b", "lessThan": "d8f3f94dc950e7c62c96af432c26745885b0a18a", "status": "affected", "versionType": "git"}, {"version": "51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b", "lessThan": "4f76435fd517981f01608678c06ad9718a86ee98", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfsd/nfs4xdr.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d8f3f94dc950e7c62c96af432c26745885b0a18a"}, {"url": "https://git.kernel.org/stable/c/4f76435fd517981f01608678c06ad9718a86ee98"}], "title": "NFSD: Define actions for the new time_deleg FATTR4 attributes", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4xdr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d8f3f94dc950e7c62c96af432c26745885b0a18a", "status": "affected", "version": "51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b", "versionType": "git"}, {"lessThan": "4f76435fd517981f01608678c06ad9718a86ee98", "status": "affected", "version": "51c0d4f7e317d3cb4a3001e502bd8ca2d57f2a4b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfsd/nfs4xdr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Define actions for the new time_deleg FATTR4 attributes\n\nNFSv4 clients won't send legitimate GETATTR requests for these new\nattributes because they are intended to be used only with CB_GETATTR\nand SETATTR. But NFSD has to do something besides crashing if it\never sees a GETATTR request that queries these attributes.\n\nRFC 8881 Section 18.7.3 states:\n\n> The server MUST return a value for each attribute that the client\n> requests if the attribute is supported by the server for the\n> target file system. If the server does not support a particular\n> attribute on the target file system, then it MUST NOT return the\n> attribute value and MUST NOT set the attribute bit in the result\n> bitmap. The server MUST return an error if it supports an\n> attribute on the target but cannot obtain its value. In that case,\n> no attribute values will be returned.\n\nFurther, RFC 9754 Section 5 states:\n\n> These new attributes are invalid to be used with GETATTR, VERIFY,\n> and NVERIFY, and they can only be used with CB_GETATTR and SETATTR\n> by a client holding an appropriate delegation.\n\nThus there does not appear to be a specific server response mandated\nby specification. Taking the guidance that querying these attributes\nvia GETATTR is \"invalid\", NFSD will return nfserr_inval, failing the\nrequest entirely."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nNFSD: Definir acciones para los nuevos atributos time_deleg FATTR4\n\nLos clientes NFSv4 no enviar\u00e1n solicitudes GETATTR leg\u00edtimas para estos nuevos atributos porque est\u00e1n destinados a ser usados solo con CB_GETATTR y SETATTR. Pero NFSD tiene que hacer algo adem\u00e1s de colapsar si alguna vez ve una solicitud GETATTR que consulta estos atributos.\n\nLa Secci\u00f3n 18.7.3 del RFC 8881 establece:\n\n> El servidor DEBE devolver un valor para cada atributo que el cliente solicita si el atributo es compatible con el servidor para el sistema de archivos de destino. Si el servidor no es compatible con un atributo particular en el sistema de archivos de destino, entonces NO DEBE devolver el valor del atributo y NO DEBE establecer el bit del atributo en el mapa de bits de resultado. El servidor DEBE devolver un error si es compatible con un atributo en el destino pero no puede obtener su valor. En ese caso, no se devolver\u00e1n valores de atributo.\n\nAdem\u00e1s, la Secci\u00f3n 5 del RFC 9754 establece:\n\n> Estos nuevos atributos no son v\u00e1lidos para ser usados con GETATTR, VERIFY y NVERIFY, y solo pueden ser usados con CB_GETATTR y SETATTR por un cliente que posea una delegaci\u00f3n apropiada.\n\nPor lo tanto, no parece haber una respuesta espec\u00edfica del servidor exigida por la especificaci\u00f3n. Tomando la gu\u00eda de que consultar estos atributos a trav\u00e9s de GETATTR es 'inv\u00e1lido', NFSD devolver\u00e1 nfserr_inval, fallando la solicitud por completo."}], "id": "CVE-2025-40326", "lastModified": "2026-10-14T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-12-08T01:16:05.337", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4f76435fd517981f01608678c06ad9718a86ee98"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d8f3f94dc950e7c62c96af432c26745885b0a18a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: NFSD: Define actions for the new time_deleg FATTR4 attributes", "id": "2419946", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419946"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40326", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40326\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40326\nhttps://lore.kernel.org/linux-cve-announce/2025120824-CVE-2025-40326-4c06@gregkh/T"], "threat_severity": "Moderate"}

{}