CVE-2025-22026
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A vulnerability has been identified in the Linux kernel concerning the nfsd_proc_stat_init() function, which ignores the return code from svc_proc_register(). If the procfile creation fails, the kernel issues a warning when attempting to remove the entry later.
Risk Assessment
Ignoring the return code from svc_proc_register() may lead to improper functioning of the NFS system, potentially affecting the availability of services within the organization.
Recommendation
It is recommended to update the Linux kernel to a version where this vulnerability has been fixed to ensure proper error handling during proc file registration.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nfsd: don't ignore the return code of svc_proc_register() Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel will WARN when it tries to remove the entry later. Fix nfsd_proc_stat_init() to return the same type of pointer as svc_proc_register(), and fix up nfsd_net_init() to check that and fail the nfsd_net construction if it occurs. svc_proc_register() can fail if the dentry can't be allocated, or if an identical dentry already exists. The second case is pretty unlikely in the nfsd_net construction codepath, so if this happens, return -ENOMEM.