High · published October 7, 2025
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL
OPDESC() simply indexes into nfsd4_ops[] by the op's operation
number, without range checking that value. It assumes callers are
careful to avoid calling it with an out-of-bounds opnum value.
nfsd4_decode_compound() is not so careful, and can invoke OPDESC()
with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end
of nfsd4_ops[].
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.14, < 5.10.220 | 5.10.220 |
| linux/linux_kernel | ≥ 5.11, < 5.15.107 | 5.15.107 |
| linux/linux_kernel | ≥ 5.16, < 6.1.24 | 6.1.24 |
| linux/linux_kernel | ≥ 6.2, < 6.2.11 | 6.2.11 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |