Executive brief
A vulnerability was identified in the Linux kernel's Network File System (NFS) server component. The issue occurs when the server processes certain types of network requests without properly verifying their format, which can lead to unpredictable system behavior or instability. This could potentially allow a remote user to cause a service disruption, affecting the availability of shared files and corporate data storage.
Technical details
A vulnerability in the Linux kernel's NFS server (nfsd) arises because the function nfsd4_spo_must_allow() does not verify that an incoming RPC procedure is specifically an NFSPROC4_COMPOUND request before accessing the compound state (cstate). If a non-v4 compound request is processed, examining the cstate leads to undefined results due to improper state assumptions. This is a logic error in the NFSv4 server implementation. An attacker could potentially exploit this via network-reachable NFS services to cause kernel instability or a denial of service. The fix introduces a check to ensure rq_procinfo matches NFSPROC4_COMPOUND and that the minor version is not zero.
Affected products
- Linux Linux Kernel All versions prior to the July 2025 patches
Timeline
- 2025-03-28: other: Patch authored by Neil Brown
- 2025-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1244f0b2c3cecd3f349a877006e67c9492b41807
- https://git.kernel.org/stable/c/2c54bd5a380ebf646fb9efbc4ae782ff3a83a5af
- https://git.kernel.org/stable/c/425efc6b3292a3c79bfee4a1661cf043dcd9cf2f
- https://git.kernel.org/stable/c/64a723b0281ecaa59d31aad73ef8e408a84cb603
- https://git.kernel.org/stable/c/7a75a956692aa64211a9e95781af1ec461642de4
- https://git.kernel.org/stable/c/b1d0323a09a29f81572c7391e0d80d78724729c9
- https://git.kernel.org/stable/c/bf78a2706ce975981eb5167f2d3b609eb5d24c19