LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40210: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"

In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"). Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in: [ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0 when NFSD attempts to allocate the COMPOUND op array. Let's restore the operation-per-COMPOUND limit, but increased to 200 for now.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A remote, unauthenticated attacker could send a malformed NFSv4 COMPOUND request that makes a vulnerable Linux NFS server attempt an extremely large memory allocation. This can exhaust resources or disrupt service. The issue affects availability; the supplied CVSS assessment does not indicate data disclosure or modification.

Executive priority

Prioritize internet-facing or broadly reachable NFS servers for immediate review and remediation. Treat internally restricted servers as high-priority patching candidates because exploitation requires neither credentials nor user action. Confirm compensating network restrictions until vendor-supported kernels are installed.

Technical view

Linux NFSD failed to cap the operation count declared in an NFSv4 COMPOUND header after commit 48aab1606fa8. An attacker-controlled count can drive allocation of an oversized COMPOUND operation array. The resolution restores a per-COMPOUND limit of 200 operations.

Likely exposure

Exposure is most likely where affected Linux kernels run NFSD and accept NFSv4 traffic from untrusted or broadly accessible networks. Systems not providing NFS services are unlikely to expose the vulnerable path. Distribution-specific package mappings are not provided, so kernel provenance must be verified.

Exploitation context

The vector is network-accessible, low-complexity, unauthenticated, and requires no user interaction. Successful abuse could cause denial of service through excessive memory allocation. The bundle does not report active exploitation, and the CVE is not listed as KEV.

Researcher notes

The vulnerable behavior was introduced by commit 48aab1606fa8, which removed the NFSv4 COMPOUND operation cap. Reported effects include an enormous vmalloc request and abnormal connection or lease state during testing. Root cause for the observed CLOSE9 hang was not established in the supplied description.

Mitigation direction

  • Update to a vendor-supported kernel containing the referenced operation-limit restoration.
  • Consult the Linux distribution's advisory for package-specific fixed versions.
  • Restrict NFSv4 access to trusted networks while updates are pending.
  • Disable NFSD where NFS service is unnecessary.

Validation and detection

  • Inventory systems running NFSD and identify their exact kernel builds.
  • Confirm whether NFSv4 is reachable from untrusted or unnecessary network segments.
  • Map kernel builds against distribution advisories and the referenced fixing commits.
  • After remediation, verify the installed kernel includes the restored 200-operation limit.
  • Monitor NFS servers for allocation failures, memory pressure, hangs, or unexpected service restarts.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40210 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2025-40210Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux48aab1606fa80027143a445224f552b4eeea845b, 48aab1606fa80027143a445224f552b4eeea845bunaffected
LinuxLinux6.17, 0, 6.17.8, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.