CVE-2025-38430

Updated: 2025-12-28 03:53:55.466925

Description:

In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x 0.0
CVSS Version 3.x MEDIUM 5.5

Status

OS name Project name Version Score Severity Status Errata Last updated

Statement

RHEL 7 ELS kernel 3.10.0 5.5 MEDIUM Ignored 2026-01-17 01:05:32 This flaw is confined to the kernel NFS server (nfsd) path and is reachable only on hosts actively s...
TuxCare 9.6 ESU kernel 5.14.0 5.5 MEDIUM Needs Triage 2025-12-28 08:10:06
Ubuntu 16.04 ELS linux-hwe 4.15.0 5.5 MEDIUM Ignored 2026-01-17 01:18:47 This flaw is confined to the kernel NFS server (nfsd) path and is reachable only on hosts actively s...
Ubuntu 16.04 ELS linux 4.4.0 5.5 MEDIUM Ignored 2026-01-17 01:13:58 This flaw is confined to the kernel NFS server (nfsd) path and is reachable only on hosts actively s...
Ubuntu 18.04 ELS linux 4.15.0 5.5 MEDIUM Ignored 2026-01-17 01:13:59 This flaw is confined to the kernel NFS server (nfsd) path and is reachable only on hosts actively s...
Ubuntu 20.04 ELS linux 5.4.0 5.5 MEDIUM Ignored 2026-01-17 01:13:59 This flaw is confined to the kernel NFS server (nfsd) path and is reachable only on hosts actively s...
Total: 16