High 7.5Published Oct 30, 2025

CVE-2025-40087NFSD: Define a proc_layoutcommit for the FlexFiles layout type

Updated under an hour ago (Oct 27, 2026, 7:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: NFSD: Define a proc_layoutcommit for the FlexFiles layout type Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT operation on a FlexFiles layout.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9b9960a0ca4773e21c4b153ed355583946346b25 before a75994dd879401c3e24ff51c2536559f1a53ea27; from 9b9960a0ca4773e21c4b153ed355583946346b25 before 34d187e020cbda112a6c6f094f0ca5e6a8672b75; from 9b9960a0ca4773e21c4b153ed355583946346b25 before ba88a53d7f5df4191583abf214214efe0cda91d2; from 9b9960a0ca4773e21c4b153ed355583946346b25 before da9129ef77786839a3ccd1d7afeeab790bceaa1d; from 9b9960a0ca4773e21c4b153ed355583946346b25 before f7353208c91ab004e0179c5fb6c365b0f132f9f0; from 9b9960a0ca4773e21c4b153ed355583946346b25 before a156af6a4dc38c2aa7c98e89520a70fb3b3e7df4; from 9b9960a0ca4773e21c4b153ed355583946346b25 before 785ec512afa80d0540f2ca797c0e56de747a6083; 9b9960a0ca4773e21c4b153ed355583946346b25 builds before 4b47a8601b71ad98833b447d465592d847b4dc77	CNA record

References

References

https://git.kernel.org/stable/c/a75994dd879401c3e24ff51c2536559f1a53ea27
https://git.kernel.org/stable/c/34d187e020cbda112a6c6f094f0ca5e6a8672b75
https://git.kernel.org/stable/c/ba88a53d7f5df4191583abf214214efe0cda91d2
https://git.kernel.org/stable/c/da9129ef77786839a3ccd1d7afeeab790bceaa1d
https://git.kernel.org/stable/c/f7353208c91ab004e0179c5fb6c365b0f132f9f0
https://git.kernel.org/stable/c/a156af6a4dc38c2aa7c98e89520a70fb3b3e7df4
https://git.kernel.org/stable/c/785ec512afa80d0540f2ca797c0e56de747a6083
https://git.kernel.org/stable/c/4b47a8601b71ad98833b447d465592d847b4dc77

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.