9.8

CVE-2025-40212: linux

CVSS: 9.8v3.1CriticalDeferred
AliasesSUSE-SU-2026:20148-1SUSE-SU-2026:20163-1SUSE-SU-2026:20165-1
Published 24-11-2025Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2025-40212 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.1% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 16
OPENSUSE-SU-2026:20145-1SUSE-SU-2026:20149-1SUSE-SU-2026:20164-1SUSE-SU-2026:20168-1SUSE-SU-2026:20169-1SUSE-SU-2026:20171-1

Timeline

  1. 24-11-2025
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those exported filesystems and so is not given access to the pseudo root filesystem. If a v3 (or v2) client uses a filehandle from that filesystem, nfsd_set_fh_dentry() will report an error, but still stores the export in "struct svc_fh" even though it also drops the reference (exp_put()). This means that when fh_put() is called an extra reference will be dropped which can lead to use-after-free and possible denial of service. Normal NFS usage will not provide a pseudo-root filehandle to a v3 client. This bug can only be triggered by the client synthesising an incorrect filehandle. To fix this we move the assignments to the svc_fh later, after all possible error cases have been detected.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

0.00 pp

From 0.40% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu103 products
  • linux< 6.17.0-14.14
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.17.0-1007.7
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Suse4 products
  • kernel-livepatch-SLE16_Update_2&distro=SUSE Linux Enterprise Server 16.0< 2-160000.1.1
  • kernel-livepatch-SLE16_Update_2&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 2-160000.1.1
  • kernel-livepatch-SLE16_Update_2&distro=SUSE Linux Micro 6.2< 2-160000.1.1
  • kernel-livepatch-SLE16-RT_Update_2&distro=SUSE Linux Micro 6.2< 2-160000.1.1
Debian1 product
  • linux< 6.12.63-1 | < 6.17.9-1
Linux1 product
  • linux≥ ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444, < b6bc86ce3944b10b9fc181fc00c1a520a20ed965 | ≥ ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444, < c83d7365cec5eb5ebeeee2a72e29b4ca58a7e4c2 | ≥ ef7f6c4904d03ccd7478e1ac20ed75f79c4ac444, < 8a7348a9ed70bda1c1f51d3f1815bcbdf9f3b38c | 6.12

4 vendors · 109 products

References

17 links
Show all 17 references