CVE-2025-40212 @ mufasa

"CVE-2025-40212"
"filesystem"
"Am I vulnerable?"

Status

not_applicable

Priority

7.96

Match score

2.5

Risk

InfoLeak MemCorrupt DoS priv:root

CVSS

9.8 CRITICAL

Reason

packages: filesystem

Created

2026-08-02T02:51:24Z

Updated

2026-08-02T09:01:01Z

Closed

2026-08-02T09:01:01Z

Package interrogation (copy)

Run on the host — click to copy a command. RPM

Package	Commands
filesystem

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: filesystem

Same product CVEs in your queue

Other tickets that look like the same product (from match reason). Relate them here to triage this CVE as the primary.

CVE	CVSS	Systems	Status	Matched	Already related
CVE-2026-67429	10.0	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-45661	9.9	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-68770	9.8	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-36829	9.8	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-25879	9.8	morris, mufasa	does_not_affect	filesystem	—
CVE-2026-47162	8.8	Archive, Janus, Library, Matrix, Saiph	accepted_risk	filesystem	—
CVE-2023-4692	7.5	Archive, Janus, Library, Saiph, morris …	accepted_risk, fixed	filesystem	—

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

CloudLinux release 7.9 (Boris Yegorov) (7.9) · cloudlinux

Arch

x86_64

kernel_release

uname -r → 3.10.0-962.3.2.lve1.5.89.el7.x86_64

kernel_version

uname -v → #1 SMP Thu Jul 9 15:55:31 UTC 2026

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
morris	not_applicable	7.96	2026-08-02T08:59:40Z	Open

Description

In the Linux kernel, the following vulnerability has been resolved:

nfsd: fix refcount leak in nfsd_set_fh_dentry()

nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find
the various exported filesystems using LOOKUP requests from a known root
filehandle.  NFSv3 uses the MOUNT protocol to find those exported
filesystems and so is not given access to the pseudo root filesystem.

If a v3 (or v2) client uses a filehandle from that filesystem,
nfsd_set_fh_dentry() will report an error, but still stores the export
in "struct svc_fh" even though it also drops the reference (exp_put()).
This means that when fh_put() is called an extra reference will be dropped
which can lead to use-after-free and possible denial of service.

Normal NFS usage will not provide a pseudo-root filehandle to a v3
client.  This bug can only be triggered by the client synthesising an
incorrect filehandle.

To fix this we move the assignments to the svc_fh later, after all
possible error cases have been detected.

Determination

lsmod | grep nfsd
[root@mufasa ~]#  systemctl status nfs-server
● nfs-server.service - NFS server and services
   Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
[root@mufasa ~]# systemctl status nfs
● nfs-server.service - NFS server and services
   Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
[root@mufasa ~]# exportfs -v

Update status

Add note only

Mitigation log

2026-08-02T09:01:01Z — not_applicable

lsmod | grep nfsd [root@mufasa ~]# systemctl status nfs-server ● nfs-server.service - NFS server and services Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; disabled; vendor preset: disabled) Active: inactive (dead) [root@mufasa ~]# systemctl status nfs ● nfs-server.service - NFS server and services Loaded: loaded (/usr/lib/systemd/system/nfs-server.service; disabled; vendor preset: disabled) Active: inactive (dead) [root@mufasa ~]# exportfs -v

References

NVD: CVE-2025-40212