In the Linux kernel, the following vulnerability has been resolved:
nfsd: nfsd4spomust_allow() must check this is a v4 compound request
If the request being processed is not a v4 compound request, then examining the cstate can have undefined results.
This patch adds a check that the rpc procedure being executed (rqprocinfo) is the NFSPROC4COMPOUND procedure.
[
{
"id": "CVE-2025-38430-0b45ab9f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64a723b0281ecaa59d31aad73ef8e408a84cb603",
"digest": {
"line_hashes": [
"312827914088815811589118324337012911990",
"191144571428977602843750966228050824602",
"130526059806196560863481698337168201589",
"82985724190689291085411434777583528622"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-0deff0e1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@425efc6b3292a3c79bfee4a1661cf043dcd9cf2f",
"digest": {
"length": 599.0,
"function_hash": "222507000104005917974024376374059262775"
},
"target": {
"file": "fs/nfsd/nfs4proc.c",
"function": "nfsd4_spo_must_allow"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-1a7ccf2a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@425efc6b3292a3c79bfee4a1661cf043dcd9cf2f",
"digest": {
"line_hashes": [
"312827914088815811589118324337012911990",
"191144571428977602843750966228050824602",
"130526059806196560863481698337168201589",
"82985724190689291085411434777583528622"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-234a2f09",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c54bd5a380ebf646fb9efbc4ae782ff3a83a5af",
"digest": {
"length": 599.0,
"function_hash": "222507000104005917974024376374059262775"
},
"target": {
"file": "fs/nfsd/nfs4proc.c",
"function": "nfsd4_spo_must_allow"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-759c1459",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1244f0b2c3cecd3f349a877006e67c9492b41807",
"digest": {
"line_hashes": [
"312827914088815811589118324337012911990",
"191144571428977602843750966228050824602",
"130526059806196560863481698337168201589",
"82985724190689291085411434777583528622"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-9c2755af",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c54bd5a380ebf646fb9efbc4ae782ff3a83a5af",
"digest": {
"line_hashes": [
"312827914088815811589118324337012911990",
"191144571428977602843750966228050824602",
"130526059806196560863481698337168201589",
"82985724190689291085411434777583528622"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-9c8542e8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7e943ddd1c6731812357a28e7954ade3a7d8517",
"digest": {
"length": 599.0,
"function_hash": "222507000104005917974024376374059262775"
},
"target": {
"file": "fs/nfsd/nfs4proc.c",
"function": "nfsd4_spo_must_allow"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-bd277c06",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a75a956692aa64211a9e95781af1ec461642de4",
"digest": {
"length": 599.0,
"function_hash": "222507000104005917974024376374059262775"
},
"target": {
"file": "fs/nfsd/nfs4proc.c",
"function": "nfsd4_spo_must_allow"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-bf265bda",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1d0323a09a29f81572c7391e0d80d78724729c9",
"digest": {
"line_hashes": [
"312827914088815811589118324337012911990",
"191144571428977602843750966228050824602",
"130526059806196560863481698337168201589",
"82985724190689291085411434777583528622"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-d28f4bf1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a75a956692aa64211a9e95781af1ec461642de4",
"digest": {
"line_hashes": [
"312827914088815811589118324337012911990",
"191144571428977602843750966228050824602",
"130526059806196560863481698337168201589",
"82985724190689291085411434777583528622"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-dd092d2e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf78a2706ce975981eb5167f2d3b609eb5d24c19",
"digest": {
"line_hashes": [
"312827914088815811589118324337012911990",
"191144571428977602843750966228050824602",
"328221394260381016248619657452101029553",
"40973333907338023311477835027528097439"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-e5c3f70f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64a723b0281ecaa59d31aad73ef8e408a84cb603",
"digest": {
"length": 599.0,
"function_hash": "222507000104005917974024376374059262775"
},
"target": {
"file": "fs/nfsd/nfs4proc.c",
"function": "nfsd4_spo_must_allow"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-e5c9022a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7e943ddd1c6731812357a28e7954ade3a7d8517",
"digest": {
"line_hashes": [
"312827914088815811589118324337012911990",
"191144571428977602843750966228050824602",
"130526059806196560863481698337168201589",
"82985724190689291085411434777583528622"
],
"threshold": 0.9
},
"target": {
"file": "fs/nfsd/nfs4proc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-ea823036",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf78a2706ce975981eb5167f2d3b609eb5d24c19",
"digest": {
"length": 643.0,
"function_hash": "4296237314971048086002768349529648864"
},
"target": {
"file": "fs/nfsd/nfs4proc.c",
"function": "nfsd4_spo_must_allow"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-f82e28b5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1244f0b2c3cecd3f349a877006e67c9492b41807",
"digest": {
"length": 599.0,
"function_hash": "222507000104005917974024376374059262775"
},
"target": {
"file": "fs/nfsd/nfs4proc.c",
"function": "nfsd4_spo_must_allow"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2025-38430-f91bb3a7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1d0323a09a29f81572c7391e0d80d78724729c9",
"digest": {
"length": 599.0,
"function_hash": "222507000104005917974024376374059262775"
},
"target": {
"file": "fs/nfsd/nfs4proc.c",
"function": "nfsd4_spo_must_allow"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
]