NFSD: Release the export reference when reaping open stateids

Summary

In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4_put_stid() releases the svc_export tracked in nfs4_stid.sc_export, but free_ol_stateid_reaplist() frees open and lock stateids by calling ->sc_free() directly, bypassing that path. An open stateid takes an sc_export reference in nfs4_open() and a lock stateid takes its own in init_lock_stateid(); both reach free_ol_stateid_reaplist() through their normal teardown, the open stateid via release_open_stateid() and the lock stateid via nfsd4_release_lockowner(), each through put_ol_stateid_locked(). The reference is therefore never dropped, pinning the export and blocking unmount for the lifetime of the stateid. Release sc_export in free_ol_stateid_reaplist() the way nfs4_put_stid() does. ->sc_free() runs once per stateid, and a stateid reaches free_ol_stateid_reaplist() or nfs4_put_stid() but never both, so the reference is dropped exactly once. Revoked stateids reach this path with sc_export already cleared by drop_stid_export(), so they are skipped rather than double-freed. nfs4_put_stid() itself read sc_export before acquiring cl_lock. drop_stid_export() clears that field and releases the reference under cl_lock, so a concurrent revocation could drop the export in the window between the read and the final put, releasing the same reference twice. Read sc_export while cl_lock is held so the two paths serialize and the reference is released exactly once.

Timeline

1. Sep 17, 2026, 4:07 PM UTCCVE published
2. Oct 19, 2026, 9:00 AM UTCRecord last updated

Affected versions

• Linux Linux

  From ba0cde5dc81d214684b8ea0bd87414ba2f48fe02 · fixed in 7458727fd7cb79d09e5120b6fecc1ad11cdb0946; From ba0cde5dc81d214684b8ea0bd87414ba2f48fe02 · fixed in 6480bd703684ed3f760e9e36c4a699033c0806ae

• Linux Linux

  7.2

• KernelLinux

  From 7.2.0 · fixed in 7.2.6

References 2