CVE-2025-40087

NFSD: Define a proc_layoutcommit for the FlexFiles layout type

HIGH

7.5

CVSS Score

Published: October 30, 2025 at 09:47 AM UTC

Updated: October 19, 2026 at 09:10 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.5%

Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Define a proc_layoutcommit for the FlexFiles layout type Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT operation on a FlexFiles layout.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

90%

4.89b9960a0ca4773e21c4b153ed355583946346b25

Vendor states this is fixed in 34d187e020cbda112a6c6f094f0ca5e6a8672b75 (fixed)

Vendor states this is fixed in 4b47a8601b71ad98833b447d465592d847b4dc77 (fixed)

Vendor states this is fixed in 785ec512afa80d0540f2ca797c0e56de747a6083 (fixed)

Vendor states this is fixed in a156af6a4dc38c2aa7c98e89520a70fb3b3e7df4 (fixed)

Vendor states this is fixed in a75994dd879401c3e24ff51c2536559f1a53ea27 (fixed)

Vendor states this is fixed in ba88a53d7f5df4191583abf214214efe0cda91d2 (fixed)

Vendor states this is fixed in da9129ef77786839a3ccd1d7afeeab790bceaa1d (fixed)

Vendor states this is fixed in f7353208c91ab004e0179c5fb6c365b0f132f9f0 (fixed)

Vendor states this is fixed in 4.8 (unaffected)

Vendor states this is fixed in 5.10.246 (unaffected)

Vendor states this is fixed in 5.15.196 (unaffected)

Vendor states this is fixed in 5.4.301 (unaffected)

Vendor states this is fixed in 6.1.158 (unaffected)

Vendor states this is fixed in 6.12.55 (unaffected)

Vendor states this is fixed in 6.17.5 (unaffected)

Vendor states this is fixed in 6.18 (unaffected)

Vendor states this is fixed in 6.6.114 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord

https://git.kernel.org/stable/c/a75994dd879401c3e24ff51c2536559f1a53ea27

Source: cverecord

https://git.kernel.org/stable/c/34d187e020cbda112a6c6f094f0ca5e6a8672b75

Source: cverecord

https://git.kernel.org/stable/c/ba88a53d7f5df4191583abf214214efe0cda91d2

Source: cverecord

https://git.kernel.org/stable/c/da9129ef77786839a3ccd1d7afeeab790bceaa1d

Source: cverecord

https://git.kernel.org/stable/c/f7353208c91ab004e0179c5fb6c365b0f132f9f0

Source: cverecord

https://git.kernel.org/stable/c/a156af6a4dc38c2aa7c98e89520a70fb3b3e7df4

Source: cverecord

https://git.kernel.org/stable/c/785ec512afa80d0540f2ca797c0e56de747a6083

Source: cverecord

https://git.kernel.org/stable/c/4b47a8601b71ad98833b447d465592d847b4dc77

CVSS

7.5HIGHLinux

Vector?

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card