Answer in brief
CVE-2025-38430 records a Unknown severity vulnerability in nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (generic), Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ed94164398c935a42be7b129a478eb19c598b68a <bf78a2706ce975981eb5167f2d3b609eb5d24c19 || >=ed94164398c935a42be7b129a478eb19c598b68a <b1d0323a09a29f81572c7391e0d80d78724729c9 || >=ed94164398c935a42be7b129a478eb19c598b68a <425efc6b3292a3c79bfee4a1661cf043dcd9cf2f || >=ed94164398c935a42be7b129a478eb19c598b68a <64a723b0281ecaa59d31aad73ef8e408a84cb603 || >=ed94164398c935a42be7b129a478eb19c598b68a <e7e943ddd1c6731812357a28e7954ade3a7d8517 || >=ed94164398c935a42be7b129a478eb19c598b68a <7a75a956692aa64211a9e95781af1ec461642de4 || >=ed94164398c935a42be7b129a478eb19c598b68a <2c54bd5a380ebf646fb9efbc4ae782ff3a83a5af || >=ed94164398c935a42be7b129a478eb19c598b68a <1244f0b2c3cecd3f349a877006e67c9492b41807 | bf78a2706ce975981eb5167f2d3b609eb5d24c19, b1d0323a09a29f81572c7391e0d80d78724729c9, 425efc6b3292a3c79bfee4a1661cf043dcd9cf2f, 64a723b0281ecaa59d31aad73ef8e408a84cb603, e7e943ddd1c6731812357a28e7954ade3a7d8517, 7a75a956692aa64211a9e95781af1ec461642de4, 2c54bd5a380ebf646fb9efbc4ae782ff3a83a5af, 1244f0b2c3cecd3f349a877006e67c9492b41807 |
| Linux/Linuxgeneric | 4.8 | Not reported |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFPgeneric | >=V3.1.5 <* | * |
Published upstream
Jul 25, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4 compound request, then examining the cstate can have undefined results. This patch adds a check that the rpc procedure being executed (rq_procinfo) is the NFSPROC4_COMPOUND procedure.
Quoted source text, attributed separately from HOL analysis.