CVE-2025-22026VulnerabilityPublished 4 Sep 2025Updated 13 Sep 2026

Microsoft · nfsd: don't ignore the return code of svc_proc_register()

Affects MicrosoftSource GCVE Database

Mentioned vulnerabilities

CVE-2025-38718

Not known to be exploited · patch available : update Microsoft when convenient.

Data as of 26 Oct 2026, 06:26 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available

Exploitation evidence

Disclosed: evidence found.
CVE published 4 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

microsoft-security-response-ce

What to do

Affected software

Product	Affected	Fixed in
Microsoft Security Response Center Microsoft	Affected Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux AppStream (v. 10) Red Hat Enterprise Linux BaseOS (v. 10) Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) Microsoft Azure Linux 3.0 Azure Linux 3.0 2.0	Fixed in–

AI-suggested

Red Hat has released updated kernel packages that address these vulnerabilities. Users should apply the available kernel updates for Red Hat Enterprise Linux 10 as described in the Red Hat advisory RHSA-2025:17396 and reboot their systems to ensure the fixes take effect. For detailed update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.

Description

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Impact

The vulnerabilities affect the Linux kernel's NFS daemon and SCTP protocol implementations, potentially leading to improper handling of certain kernel operations. The exact impact details are not provided in the advisory, but the security rating is moderate, indicating a limited but meaningful risk if exploited. No known exploits in the wild have been reported.

Summary

Red Hat Product Security issued an advisory (RHSA-2025:17396) for Red Hat Enterprise Linux 10 kernel packages addressing two vulnerabilities: CVE-2025-22026, where the NFS daemon (nfsd) did not properly handle the return code of svc_proc_register(), and CVE-2025-38718, where the SCTP protocol failed to linearize cloned GSO packets in sctp_rcv. These issues have been fixed in updated kernel packages. The advisory rates the security impact as moderate and requires a system reboot after patch installation. The advisory covers multiple architectures and extended update support versions of Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products.

CWE-252Unchecked Return Value (opens in a new tab)
Base weaknessLikelihood of exploit: LowOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Implementation
Check the results of all functions that return a value and verify that the value is expected.
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
Implementation
Ensure that you account for all possible return values from the function.
OWASP Cheat Sheets
Logging (opens in a new tab)
Error Handling (opens in a new tab)
OWASP ASVS 4.0.3
V11.1.7 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-664Improper Control of a Resource Through its Lifetime (opens in a new tab)
Pillar weakness
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Attack patterns
Session Credential Falsification through Forging (opens in a new tab)
Reusing Session IDs (aka Session Replay) (opens in a new tab)
Session Fixation (opens in a new tab)
Cross Site Request Forgery (opens in a new tab)
Exploitation of Trusted Identifiers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 25 Jun 2026, 22:29 UTC

WeaknessesCWE-252, CWE-664

Technical details

References

Community reviews

Related threats