CVE-2025-38430

In the Linux kernel, the following vulnerability has been resolved:

nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request

If the request being processed is not a v4 compound request, then examining the cstate can have undefined results.

This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure.

A vulnerability exists in the nfsd4_spo_must_allow() function, where it dereferences NFSv4-specific state without verifying that the incoming request is a v4 COMPOUND. This may lead to undefined behavior or denial of service if a non-compound RPC request is processed.

The vulnerability leads to a kernel oops or crash when a non-NFSv4 COMPOUND request is incorrectly processed by nfsd4_spo_must_allow(). The impact is limited to availability (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module nfsd from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.