by Kastro CVE-2025-38430
Linux Linux — nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request
Description · from the CVE record
In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure.
Affected
ProductAffectedFixed inSource
Linuxed94164398c935a42be7b129a478eb19c598b68a – < bf78a2706ce975981eb5167f2d3b609eb5d24c19bf78a2706ce975981eb5167f2d3b609eb5d24c19CNA
Linuxed94164398c935a42be7b129a478eb19c598b68a – < b1d0323a09a29f81572c7391e0d80d78724729c9b1d0323a09a29f81572c7391e0d80d78724729c9CNA
Linuxed94164398c935a42be7b129a478eb19c598b68a – < 425efc6b3292a3c79bfee4a1661cf043dcd9cf2f425efc6b3292a3c79bfee4a1661cf043dcd9cf2fCNA
Linuxed94164398c935a42be7b129a478eb19c598b68a – < 64a723b0281ecaa59d31aad73ef8e408a84cb60364a723b0281ecaa59d31aad73ef8e408a84cb603CNA
Linuxed94164398c935a42be7b129a478eb19c598b68a – < e7e943ddd1c6731812357a28e7954ade3a7d8517e7e943ddd1c6731812357a28e7954ade3a7d8517CNA
Linuxed94164398c935a42be7b129a478eb19c598b68a – < 7a75a956692aa64211a9e95781af1ec461642de47a75a956692aa64211a9e95781af1ec461642de4CNA
Linuxed94164398c935a42be7b129a478eb19c598b68a – < 2c54bd5a380ebf646fb9efbc4ae782ff3a83a5af2c54bd5a380ebf646fb9efbc4ae782ff3a83a5afCNA
Linuxed94164398c935a42be7b129a478eb19c598b68a – < 1244f0b2c3cecd3f349a877006e67c9492b418071244f0b2c3cecd3f349a877006e67c9492b41807CNA
Linux4.8–CNA
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.5–siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.5–siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.5–siemens-SADP
Scores by source
Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total