Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server could allow a remote attacker to crash the system. The issue occurs when the server receives specific requests for file attributes that it does not properly handle. This could lead to a complete service outage for systems providing file-sharing services.
Technical details
A vulnerability exists in the Linux kernel's NFSD (NFS server) implementation due to missing handlers for new NFSv4.2 FATTR4 attributes (FATTR4_TIME_DELEG_ACCESS and FATTR4_TIME_DELEG_MODIFY). While these attributes are intended for use with CB_GETATTR and SETATTR, a remote attacker can trigger a kernel crash by sending a standard GETATTR request querying these attributes. The root cause is the lack of defined actions in the nfsd4_enc_fattr4_encode_ops table for these specific attributes, leading to an invalid memory access or assertion failure. The fix implements a handler that returns nfserr_inval instead of crashing. The vulnerability is reachable over the network without authentication if the NFS server is exposed.
Affected products
- Linux Linux Kernel 6.14 to 6.17.8
Timeline
- 2025-09-29: other: Fix authored
- 2025-12-08: disclosed: CVE published