nfsd: guard nfsd_serv deref in nfsd_file_net_dispose

Summary

In the Linux kernel, the following vulnerability has been resolved: nfsd: guard nfsd_serv deref in nfsd_file_net_dispose nfsd_file_net_dispose() is the consumer side of l->freeme: the nfsd service thread loop calls it to drain entries that the filecache garbage collector and shrinker append via nfsd_file_dispose_list_delayed(). During per-net teardown, nn->nfsd_serv is cleared before the filecache laundrette is shut down, so the service thread can still run a dispose pass that finds more than eight entries on l->freeme and dereferences a NULL svc_serv: nfsd service thread loop nfsd_file_net_dispose(nn) if (!list_empty(&l->freeme)) { ... svc_wake_up(nn->nfsd_serv); /* nn->nfsd_serv == NULL */ } The sibling helper nfsd_file_dispose_list_delayed() already documents this ordering and caches nn->nfsd_serv into a local before testing it for NULL. nfsd_file_net_dispose() was introduced with the same raw svc_wake_up(nn->nfsd_serv) call and never picked up the guard. Fix by loading nn->nfsd_serv into a local svc_serv pointer and only calling svc_wake_up() when it is non-NULL, matching the pattern in nfsd_file_dispose_list_delayed().

Timeline

1. Sep 24, 2026, 3:10 PM UTCCVE published
2. Oct 19, 2026, 9:07 AM UTCRecord last updated

Affected versions

• Linux Linux

  From ffb402596147ac583f3464ff5c48feb9423e3838 · fixed in f4776c1c4b38fbc459420321c8ece87d0f7f95fb; From ffb402596147ac583f3464ff5c48feb9423e3838 · fixed in 59baf45a06435194005fc5fa9a42d89f77a30432; From ffb402596147ac583f3464ff5c48feb9423e3838 · fixed in 766170b4fd2daaf5c4d6735560101474e18edab6; From ffb402596147ac583f3464ff5c48feb9423e3838 · fixed in 9f1ddfc8cb9076592401a611eb3a44d36186d014

• Linux Linux

  6.9

• KernelLinux

  From 6.9.0 · fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4

References 4