CVE-2025-38430 nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
A missing check in the Linux kernel NFS server allows undefined behavior when processing non-v4 compound requests, potentially causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38430?
CVE-2025-38430 is a critical vulnerability in Debian Debian Linux, published on 25 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
If the request being processed is not a v4 compound request, then examining the cstate can have undefined results.
This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure.
Which versions are affected by CVE-2025-38430?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38430?
Apply the vendor's patch.
Is CVE-2025-38430 being exploited?
There is no known exploitation of CVE-2025-38430 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2025-38430, DEBIAN-CVE-2025-38430, GHSA-ffxp-vqfg-26jp, ROOT-OS-DEBIAN-11-CVE-2025-38430, ROOT-OS-DEBIAN-12-CVE-2025-38430, ROOT-OS-UBUNTU-2204-CVE-2025-38430 and 2 more.