CVE-2025-38430
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In the Linux kernel NFSD, nfsd4_spo_must_allow() does not check if the request is a v4 compound. If not, examining cstate can yield undefined results.
Risk Assessment
An attacker could send a malformed NFS request, leading to undefined behavior, potentially causing a crash or security breach.
Recommendation
Apply the patch that adds a check for the NFSPROC4_COMPOUND procedure before examining cstate.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure.