CVE-2025-40324

What it actually does

Null or invalid pointer access inside nfsd4_read_release() when the trace_nfsd_read_done tracepoint fires during an NFSv4 READ without a file handle.

Why it matters to the business

NFS servers can crash and reboot when diagnostic tracing is active, interrupting file access for clients and requiring manual recovery.

How an attack unfolds

An attacker issues an NFSv4 read request lacking a file handle while kernel NFS tracing is enabled; the tracepoint handler dereferences invalid memory and panics the kernel.

How to fix it

Upgrade the Linux kernel to 5.10.247 or newer. On Ubuntu 16.04 LTS and 18.04 LTS systems update ghostscript to 9.26~dfsg+0-0ubuntu0.16.04.11 or 9.26~dfsg+0-0ubuntu0.18.04.11 respectively.

How to confirm the fix worked

Confirm the running kernel is at least 5.10.247, then reproduce the pynfs read.testNoFh case with tracing enabled and verify no crash occurs.

Typical attack path

1. Enable NFS server tracing on the target system
2. Send a crafted NFSv4 READ operation without a file handle
3. Trigger the trace_nfsd_read_done tracepoint
4. Cause kernel panic and service outage

How to detect it

Search kernel logs and crash dumps for stack traces containing nfsd4_read_release or trace_nfsd_read_done around the time of NFS read operations.

What your security team should do

• Apply the kernel update to 5.10.247 or later on all affected systems
• Temporarily disable NFS tracing in production environments until patched
• Monitor kernel logs for nfsd-related oops or panic messages