NFSD: Prevent client use-after-free during close_lru reaping
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 6.6.160, 6.12.111, 6.18.51, 7.2.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's NFS server (NFSD) is affected. A race condition can let a client's memory be freed while another part of the server still uses it, which can cause a use-after-free and potentially crash the system or corrupt memory.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during close_lru reaping An nfs4_openowner left on nn->close_lru after its final CLOSE keeps its last closed stateid in oo_last_closed_stid, holding only a raw pointer to its nfs4_client. The laundromat reaps timed-out entries, drops nn->client_lock, and calls nfs4_put_stid(), which dereferences the client through cl_lock. Nothing pins the client across that window, so a concurrent force_expire_client() can free it and nfs4_put_stid() reads freed memory. __destroy_client() hits the same race, walking clp->cl_openowners without cl_lock. Pin the client with cl_rpc_users before dropping client_lock, and skip clients already expiring. __destroy_client() then cleans up its own close_lru entries through release_last_closed_stateid(), so teardown no longer races the laundromat.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 217526e7ecc9f6f243e976772e81eab7ab986a4c · fixed in adc34b5df5c5d87043cb500b0867fc1c4ad0117e; From 217526e7ecc9f6f243e976772e81eab7ab986a4c · fixed in 0763482227822f7343557f086afc382086d56c4c; From 217526e7ecc9f6f243e976772e81eab7ab986a4c · fixed in 83dd59ac1c3455c2c7d8ddb582d980a13199b9b3; From 217526e7ecc9f6f243e976772e81eab7ab986a4c · fixed in e57a9ed34ea8c17e831de59b8f1a6b2d80d347a1; From 217526e7ecc9f6f243e976772e81eab7ab986a4c · fixed in 2330b788d732f43668b965b3105b37ceb276dfea
- Linux Linux
3.17
- KernelLinux
From 3.17.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.5