External risk intelligence

Linux Kernel NFS Refcount Leak Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-40212

This vulnerability affects the Linux kernel NFS daemon (nfsd) and requires a client to synthesize an incorrect filehandle to trigger the flaw. NFS services are typically deployed within internal, trusted network segments and are not designed to be exposed directly to the public internet.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Linux kernel's NFS server, specifically how it handles file requests. While a critical vulnerability exists, it requires a client to deliberately send malformed requests, which is an unlikely scenario in normal operations. The primary concern is confirming whether this specific, uncommon attack vector is relevant to our environment.

Issue: Flaw in NFS server's file handling.
Why remember: Rare trigger, but impacts kernel services.
Executive takeaway: Confirm relevance; low likelihood of impact.

Attack Path

How an attacker could exploit the issue

An attacker could trigger this vulnerability by sending specially crafted requests to an NFS server. The NFS server, when processing these requests, might incorrectly handle filehandles, leading to a use-after-free condition. This could potentially allow an attacker to cause a denial of service or gain unauthorized access to information.

Requires network access to NFS server.
Client synthesizes incorrect filehandle.
Use-after-free leading to denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's NFS daemon could potentially lead to a denial of service when an NFSv3 or v2 client attempts to use a malformed filehandle pointing to the "pseudo root filesystem." This scenario is only achievable when a client actively synthesizes an incorrect filehandle, which is not typical NFS usage.

NFS server filehandles could be at risk.
Malformed filehandles may trigger exposure.
Denial of service is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's NFS daemon (nfsd) has a refcount leak in `nfsd_set_fh_dentry()` that can lead to use-after-free and potential denial of service. This vulnerability requires a client to synthesize an incorrect filehandle, making it difficult to trigger under normal NFSv3 or v4 usage. The primary team responsible for addressing this would be the infrastructure or platform team managing the Linux kernel and NFS services. The first practical step is to identify all NFS servers, confirm their exposure, and assess business criticality before planning remediation, likely coordinated with the vendor if using a commercial Linux distribution.

Infrastructure or platform teams own resolution.
Verify NFS server exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel nfsd component?

The nfsd is a kernel-level service that enables a Linux machine to act as a Network File System (NFS) server. It allows remote clients to access and manage files stored on the server as if they were local. This component manages various tasks, including handling filehandle lookups and managing the export of different filesystems to authorized clients over the network.

How does CVE-2025-40212 create a vulnerability?

This CVE describes a reference count leak in the server's file handling logic. When the server processes an invalid filehandle request from an NFSv3 or v2 client, it incorrectly tracks a reference to an export object. This memory management error can lead to a use-after-free condition, where the system attempts to access memory that has already been released, potentially causing a crash or service instability.

When can this vulnerability be triggered?

The flaw is triggered only when a client intentionally generates and sends a malformed or synthesized filehandle to the server. Standard NFS operations, which follow legitimate request patterns, do not trigger this error. The vulnerability specifically requires this non-standard client behavior; a regular client interacting with the server under normal operating conditions will not hit this condition.

Is my server at risk according to Halo Surface Signal?

Halo Surface Signal indicates that exploitation is very unlikely because NFS services are typically confined to internal, trusted network segments rather than exposed to the public internet. Since an attacker needs network access to the NFS server to send the specifically crafted requests required to trigger the bug, systems isolated from untrusted networks are at a significantly lower risk.

What are the first steps to address this CVE?

You should start by identifying all active NFS servers within your environment to understand your current footprint. Once identified, evaluate the network accessibility of these servers, prioritizing those that may be reachable from less-trusted zones. Coordinate with your infrastructure or platform teams to plan for kernel updates from your Linux distribution vendor, as this is a core component fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.