LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40212: nfsd: fix refcount leak in nfsd_set_fh_dentry()

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem. If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry() will report an error, but still stores the export in "struct svc_fh" even though it also drops the reference (exp_put()). This means that when fh_put() is called an extra reference will be dropped which can lead to use-after-free and possible denial of service. Normal NFS usage will not provide a pseudo-root filehandle to a v3 client. This bug can only be triggered by the client synthesising an incorrect filehandle. To fix this we move the assignments to the svc_fh later, after all possible error cases have been detected.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A malformed NFS filehandle sent by an NFSv2 or NFSv3 client can make an affected Linux NFS server release memory incorrectly. This may cause a use-after-free and service disruption. Normal NFS operation does not trigger the flaw; a client must deliberately synthesize an invalid filehandle.

Executive priority

Prioritize exposed NFS servers for prompt remediation, especially where untrusted clients can reach NFSv2/v3. This is not evidence of universal Linux exposure or active attacks. Inventory immediately, reduce network access, and patch affected servers through supported distribution channels.

Technical view

nfsd_set_fh_dentry() rejected a pseudo-root filehandle for NFSv2/v3 but retained an export pointer after dropping its reference. Later fh_put() could drop an additional reference, producing a use-after-free and possible denial of service. The fix delays svc_fh assignments until error checks succeed.

Likely exposure

Exposure is limited to affected Linux kernels running the kernel NFS server and reachable by clients using NFSv2 or NFSv3. The bundle lists 6.12, 6.12.59, 6.17.9, and 6.18 as affected, but distribution backports and the ambiguous “0” entry require vendor verification.

Exploitation context

The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. Triggering requires a client-generated invalid pseudo-root filehandle, which normal NFS usage does not provide to NFSv2/v3 clients. The practical concern supported by the description is denial of service.

Researcher notes

The supplied 9.8 CVSS vector claims high confidentiality, integrity, and availability impact, but the narrative directly substantiates only use-after-free and possible denial of service. It does not demonstrate information disclosure, code execution, or privilege escalation. Avoid inferring those outcomes without additional evidence.

Mitigation direction

  • Apply a vendor-supported kernel update incorporating the nfsd_set_fh_dentry() fix.
  • Restrict NFS access to trusted clients and networks until remediation is complete.
  • Disable unneeded NFSv2 or NFSv3 support according to vendor guidance.
  • Consult distribution guidance for backported package versions and reboot requirements.

Validation and detection

  • Confirm whether the Linux kernel NFS server is enabled on each host.
  • Identify whether affected systems accept NFSv2 or NFSv3 requests.
  • Map NFS reachability from untrusted, tenant, or Internet-connected networks.
  • Compare kernel package backport metadata with the cited stable fixes.
  • After updating, verify the running kernel contains the vendor-provided correction.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40212 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2025-40212Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxef7f6c4904d03ccd7478e1ac20ed75f79c4ac444, ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444, ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444unaffected
LinuxLinux6.12, 0, 6.12.59, 6.17.9, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.