Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a remote user to crash the system. By sending a specific type of file layout request (FlexFiles LAYOUTCOMMIT), an attacker can trigger a kernel crash, leading to a complete denial of service for the affected server. This impacts the availability of shared files and can disrupt business operations relying on NFS storage.
Technical details
The vulnerability exists in the NFSD (NFS server) component of the Linux kernel due to the absence of a 'proc_layoutcommit' definition for the FlexFiles layout type. A remote attacker can trigger a kernel crash (NULL pointer dereference or similar invalid access) by sending a pNFS LAYOUTCOMMIT operation to a server exporting FlexFiles layouts. The fix involves defining a stub 'nfsd4_ff_proc_layoutcommit' function that returns 'nfs_ok' to safely handle these requests. The issue was introduced in version 4.8 and has been patched in various stable branches including 5.4.301, 5.10.246, 5.15.196, and 6.1.158.
Affected products
- Linux Linux Kernel 4.8 to 6.1.158
Timeline
- 2025-10-20: patched: Initial fix authored by Chuck Lever
- 2025-10-30: disclosed: CVE-2025-40087 published
References
- https://git.kernel.org/stable/c/34d187e020cbda112a6c6f094f0ca5e6a8672b75
- https://git.kernel.org/stable/c/4b47a8601b71ad98833b447d465592d847b4dc77
- https://git.kernel.org/stable/c/785ec512afa80d0540f2ca797c0e56de747a6083
- https://git.kernel.org/stable/c/a156af6a4dc38c2aa7c98e89520a70fb3b3e7df4
- https://git.kernel.org/stable/c/a75994dd879401c3e24ff51c2536559f1a53ea27
- https://git.kernel.org/stable/c/ba88a53d7f5df4191583abf214214efe0cda91d2
- https://git.kernel.org/stable/c/da9129ef77786839a3ccd1d7afeeab790bceaa1d