{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40087","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.162Z","datePublished":"2025-10-30T09:47:56.675Z","dateUpdated":"2026-08-05T12:07:40.146Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:07:40.146Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFSD: Define a proc_layoutcommit for the FlexFiles layout type\n\nAvoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT\noperation on a FlexFiles layout."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is in the in-kernel NFS server (nfsd), reached by processing an NFSv4.1 LAYOUTCOMMIT operation received in a COMPOUND RPC from a remote client over TCP port 2049. No local access to the server is required.\nAC:L - Triggering is fully deterministic — the attacker simply issues LAYOUTGET followed by LAYOUTCOMMIT with lc_layout_type=LAYOUT_FLEX_FILES, and the unconditional call through the NULL ops->proc_layoutcommit fires every time; there is no race, timing window, or memory-layout dependency.\nPR:N - With the default AUTH_SYS flavor nfsd performs no credential verification — the client asserts its own uid, and NFSD_MAY_OWNER_OVERRIDE in the fh_verify() check is satisfied by simply claiming the file owner's uid. Any host permitted to reach the export can drive the whole sequence without possessing credentials on the server.\nUI:N - The attacker performs the mount, session setup, LAYOUTGET and LAYOUTCOMMIT entirely on their own; no action by any user or administrator on the NFS server is needed once the export is online.\nS:U - The crash occurs in the nfsd kernel thread within the same security authority as the affected kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a call through a NULL function pointer, not a read of out-of-bounds or freed memory; no kernel data or pointer values are disclosed to the remote client.\nI:N - No memory is written and no control-flow hijack is achievable — the target address is 0, which cannot be mapped by a remote attacker, so no file or kernel data is modified.\nA:H - The NULL dereference produces a kernel oops that kills the nfsd service thread (full panic when panic_on_oops is set) and leaks the export/stateid references held by nfsd4_layoutcommit(), rendering the NFS server unavailable; it can be re-triggered at will."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/flexfilelayout.c"],"versions":[{"version":"9b9960a0ca4773e21c4b153ed355583946346b25","lessThan":"a75994dd879401c3e24ff51c2536559f1a53ea27","status":"affected","versionType":"git"},{"version":"9b9960a0ca4773e21c4b153ed355583946346b25","lessThan":"34d187e020cbda112a6c6f094f0ca5e6a8672b75","status":"affected","versionType":"git"},{"version":"9b9960a0ca4773e21c4b153ed355583946346b25","lessThan":"ba88a53d7f5df4191583abf214214efe0cda91d2","status":"affected","versionType":"git"},{"version":"9b9960a0ca4773e21c4b153ed355583946346b25","lessThan":"da9129ef77786839a3ccd1d7afeeab790bceaa1d","status":"affected","versionType":"git"},{"version":"9b9960a0ca4773e21c4b153ed355583946346b25","lessThan":"f7353208c91ab004e0179c5fb6c365b0f132f9f0","status":"affected","versionType":"git"},{"version":"9b9960a0ca4773e21c4b153ed355583946346b25","lessThan":"a156af6a4dc38c2aa7c98e89520a70fb3b3e7df4","status":"affected","versionType":"git"},{"version":"9b9960a0ca4773e21c4b153ed355583946346b25","lessThan":"785ec512afa80d0540f2ca797c0e56de747a6083","status":"affected","versionType":"git"},{"version":"9b9960a0ca4773e21c4b153ed355583946346b25","lessThan":"4b47a8601b71ad98833b447d465592d847b4dc77","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/nfsd/flexfilelayout.c"],"versions":[{"version":"4.8","status":"affected"},{"version":"0","lessThan":"4.8","status":"unaffected","versionType":"semver"},{"version":"5.4.301","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.246","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.196","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.158","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.114","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.55","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.17.5","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"5.4.301"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"5.10.246"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"5.15.196"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.1.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.6.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.12.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.17.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.8","versionEndExcluding":"6.18"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/a75994dd879401c3e24ff51c2536559f1a53ea27"},{"url":"https://git.kernel.org/stable/c/34d187e020cbda112a6c6f094f0ca5e6a8672b75"},{"url":"https://git.kernel.org/stable/c/ba88a53d7f5df4191583abf214214efe0cda91d2"},{"url":"https://git.kernel.org/stable/c/da9129ef77786839a3ccd1d7afeeab790bceaa1d"},{"url":"https://git.kernel.org/stable/c/f7353208c91ab004e0179c5fb6c365b0f132f9f0"},{"url":"https://git.kernel.org/stable/c/a156af6a4dc38c2aa7c98e89520a70fb3b3e7df4"},{"url":"https://git.kernel.org/stable/c/785ec512afa80d0540f2ca797c0e56de747a6083"},{"url":"https://git.kernel.org/stable/c/4b47a8601b71ad98833b447d465592d847b4dc77"}],"title":"NFSD: Define a proc_layoutcommit for the FlexFiles layout type","x_generator":{"engine":"bippy-1.2.0"}}}}