The vulnerability (CVE-2025-40210) arises from the Linux kernel NFSD component removing the cap on the number of operations allowed in an NFSv4 COMPOUND request. An attacker can exploit this by sending a COMPOUND request with an extremely large operation count, triggering the kernel to allocate an excessively large amount of memory (e.g., over a terabyte), which fails and causes the NFS server to hang or crash. This denial of service condition was traced to commit 48aab1606fa8. The fix involves reverting this commit and reinstating an operation limit of 200 per COMPOUND request.

This vulnerability results in a denial of service (DoS) condition against the Linux NFS server by causing it to hang indefinitely or crash due to failed memory allocation attempts triggered by maliciously crafted NFSv4 COMPOUND requests with large operation counts. There is no indication of confidentiality or integrity impact.

A fix is available that reverts the commit which removed the operation limit on NFSv4 COMPOUND requests, restoring a cap of 200 operations per request. Users should apply this official fix to prevent exploitation. No additional mitigation steps are indicated by the vendor advisory.