GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40212 (GCVE-0-2025-40212)

Vulnerability from cvelistv5 – Published: 2025-11-24 13:04 – Updated: 2026-08-05 12:08
VLAI
Title
nfsd: fix refcount leak in nfsd_set_fh_dentry()
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem. If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry() will report an error, but still stores the export in "struct svc_fh" even though it also drops the reference (exp_put()). This means that when fh_put() is called an extra reference will be dropped which can lead to use-after-free and possible denial of service. Normal NFS usage will not provide a pseudo-root filehandle to a v3 client. This bug can only be triggered by the client synthesising an incorrect filehandle. To fix this we move the assignments to the svc_fh later, after all possible error cases have been detected.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444 , < b6bc86ce3944b10b9fc181fc00c1a520a20ed965 (git)
Affected: ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444 , < c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2 (git)
Affected: ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444 , < 8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.59 , ≤ 6.12.* (semver)
Unaffected: 6.17.9 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfsfh.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b6bc86ce3944b10b9fc181fc00c1a520a20ed965",
              "status": "affected",
              "version": "ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444",
              "versionType": "git"
            },
            {
              "lessThan": "c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2",
              "status": "affected",
              "version": "ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444",
              "versionType": "git"
            },
            {
              "lessThan": "8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c",
              "status": "affected",
              "version": "ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfsfh.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.59",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.9",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix refcount leak in nfsd_set_fh_dentry()\n\nnfsd exports a \"pseudo root filesystem\" which is used by NFSv4 to find\nthe various exported filesystems using LOOKUP requests from a known root\nfilehandle.  NFSv3 uses the MOUNT protocol to find those exported\nfilesystems and so is not given access to the pseudo root filesystem.\n\nIf a v3 (or v2) client uses a filehandle from that filesystem,\nnfsd_set_fh_dentry() will report an error, but still stores the export\nin \"struct svc_fh\" even though it also drops the reference (exp_put()).\nThis means that when fh_put() is called an extra reference will be dropped\nwhich can lead to use-after-free and possible denial of service.\n\nNormal NFS usage will not provide a pseudo-root filehandle to a v3\nclient.  This bug can only be triggered by the client synthesising an\nincorrect filehandle.\n\nTo fix this we move the assignments to the svc_fh later, after all\npossible error cases have been detected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the in-kernel NFS server (nfsd) and is triggered by a crafted filehandle sent by a remote NFSv3/v2 client over the network (TCP/UDP port 2049).\nAC:L - The attacker fully controls the synthesized filehandle and triggers the double exp_put deterministically with a single request; the required V4ROOT pseudo-root export exists by default whenever NFSv4 is enabled, and no race is involved.\nPR:N - NFS clients are unauthenticated at the network level (AUTH_SYS/AUTH_NULL merely assert an identity), and the bug requires no OS privileges on the server \u2014 a malicious client simply synthesizes an invalid pseudo-root filehandle.\nUI:N - Exploitation requires only that the attacker send a crafted NFSv3 request; no action by any local user or administrator is needed.\nS:U - The use-after-free is confined to the kernel\u0027s own memory/security authority with no crossing of a trust boundary such as a VM or IOMMU.\nC:H - The over-released svc_export becomes a use-after-free object; per UAF scoring the attacker can gain control over freed/reallocated memory contents, enabling arbitrary kernel information disclosure.\nI:H - A use-after-free of a heap object (svc_export) enables heap grooming and write primitives against the reallocated memory, supporting kernel integrity compromise and control-flow hijacking.\nA:H - The premature free of an in-use svc_export reliably causes use-after-free crashes/oops, and repeated requests can drive the refcount underflow to panic the server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:08:37.417Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b6bc86ce3944b10b9fc181fc00c1a520a20ed965"
        },
        {
          "url": "https://git.kernel.org/stable/c/c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c"
        }
      ],
      "title": "nfsd: fix refcount leak in nfsd_set_fh_dentry()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40212",
    "datePublished": "2025-11-24T13:04:20.888Z",
    "dateReserved": "2025-04-16T07:20:57.179Z",
    "dateUpdated": "2026-08-05T12:08:37.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40212",
      "date": "2026-09-16",
      "epss": "0.00401",
      "percentile": "0.33909"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40212\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-11-24T13:16:02.813\",\"lastModified\":\"2026-07-30T06:24:18.133\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfsd: fix refcount leak in nfsd_set_fh_dentry()\\n\\nnfsd exports a \\\"pseudo root filesystem\\\" which is used by NFSv4 to find\\nthe various exported filesystems using LOOKUP requests from a known root\\nfilehandle.  NFSv3 uses the MOUNT protocol to find those exported\\nfilesystems and so is not given access to the pseudo root filesystem.\\n\\nIf a v3 (or v2) client uses a filehandle from that filesystem,\\nnfsd_set_fh_dentry() will report an error, but still stores the export\\nin \\\"struct svc_fh\\\" even though it also drops the reference (exp_put()).\\nThis means that when fh_put() is called an extra reference will be dropped\\nwhich can lead to use-after-free and possible denial of service.\\n\\nNormal NFS usage will not provide a pseudo-root filehandle to a v3\\nclient.  This bug can only be triggered by the client synthesising an\\nincorrect filehandle.\\n\\nTo fix this we move the assignments to the svc_fh later, after all\\npossible error cases have been detected.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/nfsd/nfsfh.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444\",\"lessThan\":\"b6bc86ce3944b10b9fc181fc00c1a520a20ed965\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444\",\"lessThan\":\"c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444\",\"lessThan\":\"8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/nfsd/nfsfh.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.59\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.9\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b6bc86ce3944b10b9fc181fc00c1a520a20ed965\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:48:03+00:00",
      "cve": "CVE-2025-40212",
      "id": "CVE-2025-40212",
      "initial_release_date": "2025-11-24T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nfsd: fix refcount leak in nfsd_set_fh_dentry()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40212.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T01:54:53Z",
      "cve": "CVE-2025-40212",
      "id": "CVE-2025-40212",
      "initial_release_date": "2025-11-25T00:25:25Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "512",
      "product_status:recommended": "184",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40212",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40212.json",
      "version": "26"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.