nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.109, 6.18.50, 7.2.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding fi_lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering the BUG_ON. This race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall. When the first client doesn't respond to the recall, the laundromat revokes it. A concurrent LAYOUTGET from any client using the delegation stateid hits the race window. Fix this by taking fi_lock around the fi_deleg_file read in the SC_TYPE_DELEG path, matching the locking discipline of the find_any_file() arm, and replacing the BUG_ON with a graceful error return that cleans up the partially-initialized layout stateid.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From c5c707f96fc9a6e5a57ca5baac892673270abe3d · fixed in d12af460df27876661707efab3a8532146cb961f; From c5c707f96fc9a6e5a57ca5baac892673270abe3d · fixed in c517f27498757e616d2a8fe6d16caad1fee422e6; From c5c707f96fc9a6e5a57ca5baac892673270abe3d · fixed in 607a56fea772c1f4f4989d8e255dd4f7192d9604; From c5c707f96fc9a6e5a57ca5baac892673270abe3d · fixed in 97bda8b4284d90897a1f1922e5082ff9e35d7c7e; From c5c707f96fc9a6e5a57ca5baac892673270abe3d · fixed in ca94ba36172046be6a694a7986f6931e47ed4d51
- Linux Linux
4.0
- KernelLinux
From 4.0.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4