Junglewise Threat Intelligence

CVE-2025-40273: Linux Kernel NFSD list corruption in nfs4_free_ol_stateid

CVE-2025-40273 · Severity: high · CVSS 8.8 · Published 2025-12-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Network File System (NFS) server component could allow an attacker to cause a system crash or potentially corrupt data. The issue occurs when the server fails to properly clean up internal tracking information after a client reboots, leading to memory management errors. This could result in a complete denial of service for the affected server, impacting business operations and data availability.

Technical details

A vulnerability exists in the Linux kernel NFSD implementation due to improper handling of 'copynotify' stateids within the nfs4_free_ol_stateid() function. When a client reboots and initiates a new session, the server expires the previous state; however, if a COPY_NOTIFY operation was active, its associated stateid remains in a list linked to the now-freed parent stateid. This leads to list corruption when the 'laundromat' process later attempts to free the orphaned copynotify state. An attacker with network access and basic authenticated file access (PR:L) can trigger this condition to cause a kernel panic (Oops) or potentially achieve further memory corruption. The fix ensures that associated copynotify stateids are explicitly freed when the parent open-owner stateid is released.

Affected products

  • Linux Linux Kernel 624322f1adc5 to 935a2dc8928670bb2c37e21025331e61ec48ccf4

Timeline

  • 2025-10-14: disclosed: Initial patch submission by Olga Kornievskaia
  • 2025-11-24: patched: Patch committed to stable kernel tree
  • 2025-12-06: advisory: CVE-2025-40273 published

References

Related threats