Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-40212— nfsd: fix refcount leak in nfsd_set_fh_dentry()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nfsd_set_fh_dentry函数存在引用计数泄漏，可能导致释放后重用和拒绝服务。

CVSS 9.8 · Critical EPSS 0.40% · P33

Possible ATT&CK Techniques 2 AI

T1079 T1498 · Network Denial of Service

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444< b6bc86ce3944b10b9fc181fc00c1a520a20ed965 affected
ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444< c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2 affected
ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444< 8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c affected
6.12 affected
< 6.12 unaffected
6.12.59≤ 6.12.* unaffected
6.17.9≤ 6.17.* unaffected
6.18≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-40212

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nfsd: fix refcount leak in nfsd_set_fh_dentry()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem. If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry() will report an error, but still stores the export in "struct svc_fh" even though it also drops the reference (exp_put()). This means that when fh_put() is called an extra reference will be dropped which can lead to use-after-free and possible denial of service. Normal NFS usage will not provide a pseudo-root filehandle to a v3 client. This bug can only be triggered by the client synthesising an incorrect filehandle. To fix this we move the assignments to the svc_fh later, after all possible error cases have been detected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于nfsd_set_fh_dentry函数存在引用计数泄漏，可能导致释放后重用和拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444 ~ b6bc86ce3944b10b9fc181fc00c1a520a20ed965 -
Linux Linux 6.12 -

II. Public POCs for CVE-2025-40212

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-40212

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-40212

No comments yet

Leave a comment