CVE-2025-40087: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40087 is a denial-of-service vulnerability in the Linux kernel's NFSD (Network File System Daemon) subsystem caused by a missing proc_layoutcommit handler for the FlexFiles layout type. When a pNFS client sends a LAYOUTCOMMIT operation targeting a FlexFiles layout, the kernel crashes due to the absent handler. The vulnerability was published on October 30, 2025, and affects Linux kernel versions from 4.8 up to the patched releases. It carries a CVSS v3.1 base score of 5.5 (Medium), with a local attack vector and high availability impact (Red Hat CVE, MSRC).

The root cause is a missing function pointer (proc_layoutcommit) in the FlexFiles layout driver within the Linux kernel's NFSD implementation (CWE-476: NULL Pointer Dereference). When a pNFS client issues a LAYOUTCOMMIT RPC operation on a FlexFiles layout, the NFSD code attempts to invoke the layout type's proc_layoutcommit callback, which was not defined for FlexFiles, resulting in a null pointer dereference and kernel crash. Exploitation requires local access with low privileges — specifically, the ability to interact with or simulate a pNFS client sending crafted NFS operations to the server. The fix defines a proper proc_layoutcommit handler for the FlexFiles layout type across multiple stable kernel branches (Red Hat CVE, ENISA EUVD).

Successful exploitation causes a kernel crash on the affected Linux system, resulting in a complete denial of service (system reboot required). The impact is limited to availability — there is no confidentiality or integrity impact. Systems acting as NFS servers with pNFS and FlexFiles layout support enabled are at risk, and exploitation could disrupt all services running on the affected host (Red Hat CVE, ENISA EUVD).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of writing. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to send pNFS LAYOUTCOMMIT operations to a vulnerable NFS server, limiting the practical attack surface (Red Hat CVE, ENISA EUVD).

Patches have been released for multiple Linux kernel stable branches. Administrators should update to the following fixed versions or later: 5.4.301, 5.10.246, 5.15.196, 6.1.158, 6.6.114, 6.12.55, 6.17.5, or 6.18-rc2. Distribution-specific updates are available from Red Hat, Debian (DSA-6053-1, DLA-4379-1, DLA-4404-1), Ubuntu (USN-8033 series, USN-8034 series, USN-8141-1, USN-8163 series), openSUSE, Oracle Linux, and Amazon Linux. As a workaround where patching is not immediately possible, disabling pNFS FlexFiles layout support or restricting NFS server access to trusted clients can reduce exposure (Red Hat CVE, Debian LTS, Ubuntu USN-8033).