Security readout for executives and security teams
Plain-English summary
A Linux NFS server can examine invalid request state when processing something other than an NFSv4 compound request. The supplied score rates potential impact as critical, but the sources do not document demonstrated confidentiality, integrity, or availability consequences. Systems providing NFS services on affected kernels warrant prompt review.
Executive priority
Treat internet-accessible or broadly reachable NFS servers as urgent patching candidates. Prioritize exposed production storage and appliances, then internally restricted servers. The critical score justifies rapid action, although current evidence does not establish active attacks or confirmed real-world impact.
Technical view
The kernel function nfsd4_spo_must_allow() could inspect compound-state data without first confirming the current RPC procedure is NFSPROC4_COMPOUND, producing undefined results. The stable fix adds that procedure check. Exact runtime consequences are not described in the supplied evidence.
Likely exposure
Potential exposure is limited to Linux systems running the NFS server implementation on affected kernel builds. Network accessibility increases concern. Distribution backports may change whether a reported kernel version is vulnerable, so package-specific advisories and changelogs must be checked.
Exploitation context
The CVE is not listed in KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. The 9.8 CVSS vector describes unauthenticated, low-complexity network reachability, but demonstrated exploitability and practical impact remain unclear.
Researcher notes
The key invariant is that compound state must only be examined for NFSPROC4_COMPOUND. Review vendor backports rather than relying solely on upstream version strings. The supplied affected-version data contains duplicated commit entries and does not clearly map every stable commit to a release, limiting precise exposure conclusions.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable stable fix.
- Review distribution and appliance advisories for backported fixes and required versions.
- Restrict NFS and RPC access to trusted networks while updates are pending.
- Do not treat network restriction as a substitute for patching.
Validation and detection
- Inventory hosts providing NFS services and record their running kernel builds.
- Confirm whether nfsd is active and which networks can reach NFS or RPC services.
- Map each kernel package to vendor advisories or the supplied stable commits.
- After updating, verify the fixed kernel is running and rescan affected assets.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-38430 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/bf78a2706ce975981eb5167f2d3b609eb5d24c19CVE reference, Linux
- https://git.kernel.org/stable/c/b1d0323a09a29f81572c7391e0d80d78724729c9CVE reference, Linux
- https://git.kernel.org/stable/c/425efc6b3292a3c79bfee4a1661cf043dcd9cf2fCVE reference, Linux
- https://git.kernel.org/stable/c/64a723b0281ecaa59d31aad73ef8e408a84cb603CVE reference, Linux
- https://git.kernel.org/stable/c/e7e943ddd1c6731812357a28e7954ade3a7d8517CVE reference, Linux
- https://git.kernel.org/stable/c/7a75a956692aa64211a9e95781af1ec461642de4CVE reference, Linux
- https://git.kernel.org/stable/c/2c54bd5a380ebf646fb9efbc4ae782ff3a83a5afCVE reference, Linux
- https://git.kernel.org/stable/c/1244f0b2c3cecd3f349a877006e67c9492b41807CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.