CVE-2025-40212

Vulnerability

Analysis

The Linux kernel's NFS server (nfsd) exposes a "pseudo root filesystem" for NFSv4 clients to locate exported filesystems via LOOKUP requests. NFSv2 and v3 clients are not supposed to use this pseudo root, as they rely on the MOUNT protocol. However, in nfsd_set_fh_dentry(), if an NFSv2/v3 client supplies a filehandle referencing the pseudo root filesystem, the function returns an error but still stores the export reference in struct svc_fh before dropping it with exp_put(). This mismanagement of reference counts leads to an extra exp_put() call when fh_put() is later invoked, causing a use-after-free condition [1][2][3].

Exploitation

Scenario

Normal NFS operation does not involve NFSv2/v3 clients using pseudo root filehandles; the bug is triggered only when a client intentionally or accidentally crafts an incorrect filehandle that points to the pseudo root filesystem. The attacker must be able to send NFS requests to the server, which typically requires network access. No authentication is necessary because the vulnerability occurs during filehandle processing, before access control checks are fully applied.

Impact

A successful exploit can result in a use-after-free on the export structure, potentially leading to kernel memory corruption. The primary impact is a denial of service (system crash or hang), though under precise conditions further compromise might be possible.

Mitigation

The fix moves the assignment of export and dentry pointers to struct svc_fh to after all error checks, preventing the reference leak. Patched versions are available in the stable kernel branches indicated in the commit references [1][2][3]. Administrators should apply the kernel update promptly.