SECUFOCUSNOW
Home›CVE index›CVE-2025-40273
Review reviewHigh

CVE-2025-40273

Linux

In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowne...

CVSS
8.8
EPSS
0.42%
34.2% percentile
CISA KEV
Not listed
Published
2025.12.07
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.42%
Technical severityCVSS 8.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: NFSD: free copynotify stateid in nfs4_free_ol_stateid() Typically copynotify stateid is freed either when parent's stateid is being close/freed or in nfsd4_laundromat if the stateid hasn't been used in a lease period. However, in case when the server got an OPEN (which created a parent stateid), followed by a COPY_NOTIFY using that stateid, followed by a client reboot. New client instance while doing CREATE_SESSION would force expire previous state of this client. It leads to the open state being freed thru release_openowne...

Affected product and versions

Product
Linux
Affected versions
>= 624322f1adc58acd0b69f77a6ddc764207e97241 < 935a2dc8928670bb2c37e21025331e61ec48ccf4, >= 624322f1adc58acd0b69f77a6ddc764207e97241 < b114996a095da39e38410a0328d4a8aca8c36088, >= 624322f1adc58acd0b69f77a6ddc764207e97241 < 839f56f626723f36904764858467e7a3881b975d, >= 624322f1adc58acd0b69f77a6ddc764207e97241 < 29fbb3ad4018ca2b0988fbac76f4c694cc6d7e66, >= 624322f1adc58acd0b69f77a6ddc764207e97241 < d7be15a634aa3874827d0d3ea47452ee878b8df7, >= 624322f1adc58acd0b69f77a6ddc764207e97241 < f67ad9b33b0e6f00d2acc67cbf9cfa5c756be5fb, >= 624322f1adc58acd0b69f77a6ddc764207e97241 < 4aa17144d5abc3c756883e3a010246f0dba8b468, >= 5.6
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available