CVE-2025-38430: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
In the Linux kernel, the following vulnerability has been resolved:
nfsd: nfsd4spomustallow() must check this is a v4 compound request
If the request being processed is not a v4 compound request, then examining the cstate can have undefined results.
This patch adds a check that the rpc procedure being executed (rqprocinfo) is the NFSPROC4COMPOUND procedure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38430?
CVE-2025-38430 has been categorized with a moderate severity due to potential undefined behavior in processing NFSv4 compound requests.
How do I fix CVE-2025-38430?
You can resolve CVE-2025-38430 by applying the latest patches provided by the Linux kernel maintainers that address the vulnerability.
What systems are affected by CVE-2025-38430?
CVE-2025-38430 affects systems running vulnerable versions of the Linux Kernel that include the NFS server functionality.
What is the main issue caused by CVE-2025-38430?
The main issue caused by CVE-2025-38430 is the potential for undefined results when examining the cstate in non-v4 compound requests.
When was CVE-2025-38430 resolved?
CVE-2025-38430 was resolved with a patch that introduced necessary checks for processing NFSv4 compound requests.