CVE-2025-40273: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40273 is a Linux kernel vulnerability in the NFSD (Network File System Daemon) subsystem involving improper handling of copynotify stateid during client state management. When a server processes an OPEN operation followed by a COPY_NOTIFY using that stateid, and then the client reboots, the new client instance's CREATE_SESSION forces expiration of the previous client state. This causes the open state to be freed via release_openowner -> nfs4_free_ol_stateid(), which finds an associated copynotify stateid still attached — leading to list corruption and kernel oops. The vulnerability was published on December 6, 2025, and carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Microsoft MSRC).

The root cause is a use-after-free / linked-list corruption (CWE-416/CWE-119) in fs/nfsd/nfs4state.c within the nfs4_free_ol_stateid() function, which fails to free associated copynotify stateids before releasing the parent open stateid. The specific trigger sequence is: (1) server receives OPEN creating a parent stateid, (2) client issues COPY_NOTIFY referencing that stateid, (3) client reboots and the new session's CREATE_SESSION force-expires prior state. Without the fix, the laundromat thread later attempts to free the orphaned copynotify stateid, corrupting the linked list and producing a kernel oops (Internal error: Oops - BUG: 00000000f2000800). The attack vector is local with high complexity and requires low privileges (CVSS AV:L/AC:H/PR:L), meaning exploitation requires the ability to trigger specific NFS state sequences on the server (Red Hat CVE). Patches are available in the stable kernel tree at multiple commit references (kernel.org patch 1, kernel.org patch 2).

Successful exploitation can cause kernel list corruption leading to a kernel oops/panic, resulting in a denial of service (system crash or instability) on the affected NFS server. The CVSS scoring also reflects potential high confidentiality and integrity impacts (C:H/I:H/A:H), suggesting that in certain scenarios kernel memory corruption could be leveraged beyond a crash. The primary real-world impact observed is NFS server instability and unplanned reboots, which could disrupt file services for all connected NFS clients (Red Hat CVE, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat CVE). The EPSS score is very low at approximately 0.024%, reflecting minimal near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific sequence of NFS operations (OPEN → COPY_NOTIFY → client reboot) and local or network access to trigger the state management flaw, making opportunistic exploitation unlikely (Red Hat CVE).

• Logs: Kernel warning messages in system logs: WARNING: CPU: X PID: XXXX at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd]
• Logs: Kernel oops messages: Internal error: Oops - BUG: 00000000f2000800 [#1] SMP followed by NFSD module references
• Logs: Unexpected NFS server state expiration events coinciding with client reboots in /var/log/kern.log or dmesg
• Process: Abnormal termination or restart of the nfsd kernel threads following client session re-establishment

Apply the upstream Linux kernel patch that modifies nfs4_free_ol_stateid() to properly free associated copynotify stateids before releasing the parent stateid, preventing list corruption. Patches have been committed to the stable kernel tree (commits 4aa17144, 29fbb3ad, 839f56f6, 935a2dc8). Distribution-specific updates are available from Red Hat, Ubuntu (USN-8096-1, USN-8096-2, USN-8096-3, USN-8096-5), Debian (DLA-4436-1), Amazon Linux 2 (ALAS2KERNEL-5.15-2025-096, ALAS2KERNEL-5.10-2026-112), and Microsoft Azure Linux 3 (azl3_kernel_6.6.112.1-2) (Red Hat CVE, Ubuntu USN-8096-1, Debian LTS). As a temporary workaround where patching is not immediately possible, disabling the NFSD COPY_NOTIFY feature or restricting NFS server exposure can reduce risk.