NFSD: Prevent client use-after-free during blocked-lock reaping
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 6.6.160, 6.12.111, 6.18.51, 7.2.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's NFS server (NFSD) is affected, specifically its handling of blocked file locks held by NFSv4 clients. A flaw could allow a client's memory to be freed while still in use during lock cleanup, which could lead to a use-after-free and potentially crash the system or cause memory corruption.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but no reference keeping the client alive. When the per-net laundromat reaps such a lock, freeing the nbl drops the owner reference held through flc_owner, and the final nfs4_put_stateowner() takes the client's cl_lock. Because the laundromat detaches the nbl first, __destroy_client() no longer finds it, so a concurrent force_expire_client() can free the client before nfs4_put_stateowner() runs, dereferencing cl_lock in freed memory. Pin the client with cl_rpc_users before dropping nn->blocked_locks_lock, and skip clients already expiring, whose blocked locks __destroy_client() frees while holding an owner reference. Take nn->client_lock outside nn->blocked_locks_lock. Every other site holds nn->blocked_locks_lock as a leaf, acquiring no further lock, so placing nn->client_lock outside it cannot form a lock-order cycle.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b · fixed in 0d53a47c913d0bce3b5ec35c28cbcca4d015f33d; From 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b · fixed in 7081224a59a0ca4edcd62c068588f4d900199a18; From 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b · fixed in cd489b03587378645fe0d20142a33f1ed60bac98; From 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b · fixed in 6fedb2eaff77554ca7a0deffd2e8bc0d6e8b38b0; From 7919d0a27f1e7cb324e023776aa1cbff00f1ee7b · fixed in 9026932ac8be4d0ae01db47f23619a98cc57b671
- Linux Linux
4.9
- KernelLinux
From 4.9.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.5