CVE-2025-22026

What it actually does

Ignoring the return code of svc_proc_register() in nfsd_proc_stat_init() allows procfs dentry allocation failures (or duplicate dentry cases) to go undetected during nfsd_net construction, causing a subsequent kernel WARN on entry removal and returning -ENOMEM on failure.

Why it matters to the business

Organizations running NFS server workloads on affected Linux kernels or Red Hat Ansible Automation Platform components may encounter kernel warnings, initialization failures, or reduced reliability; the large number of downstream Red Hat packages increases exposure surface but low EPSS and non-KEV status indicate limited immediate operational disruption risk.

How an attack unfolds

An attacker with local access could attempt to force nfsd_net_init() during module load in a scenario where dentry allocation fails, triggering the ignored error path and resulting WARN; no known threat actors or ransomware campaigns are associated with this issue and exploitation maturity remains none.

How to fix it

Upgrade the Linux kernel to version 6.1.164 or later; for Red Hat Ansible Automation Platform components apply the listed fixed package versions including automation-controller-venv-tower 0:4.6.2-1.el8ap / 0:4.6.2-1.el9ap, receptor 0:1.4.9-2.el8ap / 0:1.4.9-2.el9ap and their corresponding debuginfo/debugsource/receptorctl packages on both el8 and el9 variants.

How to confirm the fix worked

Verify running kernel version is at least 6.1.164 and confirm Red Hat package versions match the fixed releases; inspect nfsd initialization code paths and test that nfsd_net_init() now properly propagates svc_proc_register() errors without producing warnings.

Typical attack path

1. Obtain local access to target system
2. Trigger nfsd module initialization or nfsd_net construction
3. Force or observe failure in svc_proc_register() dentry allocation
4. Trigger cleanup path that produces kernel WARN due to ignored return code

How to detect it

Search kernel logs and dmesg for warnings originating from nfsd_net construction or proc entry removal failures; examine system boot and module load logs for nfsd_proc_stat_init or svc_proc_register error paths; correlate with any observed -ENOMEM returns during nfsd initialization.

• nfsd_proc_stat_init
• svc_proc_register
• nfsd_net_init
• WARNING:.*nfsd
• -ENOMEM.*nfsd

What your security team should do

• Prioritize kernel and Red Hat package updates on all systems exposing NFS services
• Review nfsd-related kernel logs for prior warnings indicating exposure
• Test NFS server functionality after applying fixes to confirm stable initialization
• Monitor EPSS and KEV status for any future changes in exploit likelihood