CVE-2025-38430

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The nfsd4 spo must allow() function in the Linux kernel did not verify if the request being processed was a v4 compound request. Examining the cstate in non-v4 compound requests could lead to undefined behavior. This issue has been resolved by adding a check to ensure the request is the NFSPROC4 COMPOUND procedure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.