PT-2025-47906 · Linux+3 · Linux Kernel+3
CVE-2025-40212
·
Published
2025-10-08
·
Updated
2026-03-13
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Network File System daemon (nfsd) in the Linux kernel contains a flaw related to reference counting in the
nfsd set fh dentry() function. Specifically, when an NFSv3 or NFSv2 client uses a filehandle from a pseudo-root filesystem, the function may incorrectly store the export in a struct svc fh while simultaneously dropping a reference. This can lead to a reference count leak, potentially resulting in a use-after-free condition and denial of service. This issue is triggered when a client synthesizes an incorrect filehandle. The fix involves moving assignments to the svc fh structure to occur after all error cases have been detected.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Missing Release of Resource after Effective Lifetime
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Ubuntu