CVE-2025-40210

Vulnerability

Details

In the Linux kernel NFSD subsystem, a previous commit (48aab1606fa8) removed the upper bound on the number of operations allowed in an NFSv4 COMPOUND request. This change enabled an attacker to place an arbitrarily large operation count in the COMPOUND header. When NFSD attempts to decode such a request, it tries to allocate a correspondingly massive array via vmalloc, leading to an error message like "vmalloc error: size 1209533382144, exceeds total pages" [1]. This results in a system crash or hang, effectively a denial of service.

Exploitation

The vulnerability can be exploited remotely without authentication. An attacker only needs network access to the NFS server to send a crafted NFSv4 COMPOUND containing a high op count. No other privileges are required. The lack of a limit allows the allocation size to reach terabytes, exhausting system memory and causing a kernel panic.

Impact

A successful exploit renders the NFS server unavailable and can destabilize the entire host system due to memory exhaustion or kernel panic. This is a classic denial-of-service scenario, disrupting any NFS-dependent services.

Mitigation

The fix reverts the original commit and reimposes a cap of 200 operations per COMPOUND. Patches are available in the stable kernel trees as commits b3ee7ce43228 [1] and 3e7f011c2555 [2]. Administrators should apply the latest kernel updates or backport these commits. No workaround other than patching is known; the vulnerability is not listed on KEV.