CVE-2025-40210 Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"
An attacker can cause a denial of service in the Linux kernel NFSD by sending an NFSv4 COMPOUND request with an excessively large operation count, triggering a memory allocation failure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40210?
CVE-2025-40210 is a high-severity denial of service vulnerability in Linux, published on 21 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"
I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefinitely. I've dug into it a little, but I haven't been able to root-cause it yet. However, I bisected to commit 48aab1606fa8 ("NFSD: Remove the cap on number of operations per NFSv4 COMPOUND").
Tianshuo Han also reports a potential vulnerability when decoding an NFSv4 COMPOUND. An attacker can place an arbitrarily large op count in the COMPOUND header, which results in:
[ 51.410584] nfsd: vmalloc error: size 1209533382144, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0
when NFSD attempts to allocate the COMPOUND op array.
Let's restore the operation-per-COMPOUND limit, but increased to 200 for now.
Which versions are affected by CVE-2025-40210?
How do I fix CVE-2025-40210?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-40210 being exploited?
There is no known exploitation of CVE-2025-40210 in the wild and no public exploit code.
Sources
Also known as AZL-70660, BELL-CVE-2025-40210, DEBIAN-CVE-2025-40210, GHSA-7q3v-wc68-53r6, ROOT-OS-DEBIAN-11-CVE-2025-40210, ROOT-OS-DEBIAN-12-CVE-2025-40210 and 4 more.