« List of all CVEs

CVE-2025-38430

nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request

Published: 7/25/2025 Last updated: 7/14/2026 Reserved: 4/16/2025

In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure.

CNA assigner: Linux (416baaa9-dc9f-4396-8d5f-8c081fb06d67) Requested by: n/a

Opam packages affected (29)

albatross cdrom conf-bpftool conf-libbpf conf-linux-libc-dev core core_unix hvsock mirage-block-unix mm ocaml-probes ortools_solvers orun rawlink rawlink-eio rawlink-lwt restricted shell solo5 solo5-bindings-hvt solo5-bindings-spt solo5-cross-aarch64 solo5-kernel-ukvm tracy-client tuntap uring vhd-format vhd-format-lwt xapi-stdext-unix

Products affected (4)

Product Vendor Version
Linux Linux openshift-enterprise version 3.11
Linux Linux from openshift-enterprise version 4.1 to, including 4.3
Linux Linux 2018.4.1.0
Linux Linux 2018.4.1.13

References (22)