CVE-2025-40210: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"
In the Linux kernel, the following vulnerability has been resolved:
Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"
I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND").
Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in:
[ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFPKERNEL|GFPZERO), nodemask=(null),cpuset=/,memsallowed=0
when NFSD attempts to allocate the COMPOUND op array.
Let's restore the operation-per-COMPOUND limit, but increased to 200 for now.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1007.7~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.8~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-oem-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1011.11 - Upgrade
Upgrade
ubuntu/linux-oracle-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1007.7~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1006.7~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.17.0-14.14 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.17.0-1007.7 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.17.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.17.0-1006.7 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.17.0-14.14.1 - Configuration
Restore the cap on the number of operations per NFSv4 COMPOUND request, setting the limit to 200; this reverts the removal of the cap introduced by commit 48aab1606fa8.
Linux kernel NFSD NFSv4 COMPOUND operation limit = 200
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40210?
CVE-2025-40210 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-40210?
To fix CVE-2025-40210, update your Linux kernel to the latest stable version that includes the relevant patch.
What are the consequences of CVE-2025-40210?
CVE-2025-40210 can result in NFSv4 operations hanging indefinitely, potentially causing disruptions in network file system performance.
Which software is affected by CVE-2025-40210?
CVE-2025-40210 affects the Linux kernel, specifically relating to the handling of NFSv4 COMPOUND operations.
Is there a workaround for CVE-2025-40210?
There are no official workarounds for CVE-2025-40210; the recommended action is to apply the kernel update promptly.