Linux kernel NFSD: use-after-free on the source server when CLOSE precedes FREE_STATEID during inter-server copy

Impact

On an NFS server handling NFSv4.2 inter-server copy, nfsd4_close_open_stateid() frees the lock states on its list without cleaning up the matching copy state on s2s_cp_stateids. When the client sends CLOSE before FREE_STATEID - which the Linux client sometimes does - the laundromat later walks a freed list and hits a use-after-free. That is a kernel UAF triggerable by an ordinary NFS client's legitimate request ordering, on the storage server that a whole GPU cluster mounts its datasets and checkpoints from. A panic there stalls every training job on the fleet, not one node. The fix calls nfs4_free_cpntf_statelist() in nfsd4_close_open_stateid() before the reaplist is freed.

Who can reach it

Any authenticated NFSv4.2 client that can reach the exported server and perform a server-to-server COPY, then CLOSE the open state. No special privilege beyond a normal mount; the trigger occurs in ordinary operation, not only under attack. Servers without NFSv4.2 inter-server copy enabled are not affected.

What to do

Patch the kernel on the NFS server to a stable release carrying the fix (commits in the references) and reboot it - NFSD is in-kernel, so expect an export outage and a reboot of the storage head, which means quiescing or tolerating stalled mounts cluster-wide. If patching must wait, disabling NFSv4.2 inter-server copy on the export removes the path.

References

Related entries

• AMD SMM - memory corruption (AMD-SB-4003): Memory corruption reachable in System Management Mode. Same class as theCVE-2023-20555 · AMD SMM - memory corruption (AMD-SB-4003)High
• AMD Radeon Graphics driver - IOCTL granting arbitrary I/O port and physical memory access: Improper privilegeCVE-2023-20598 · AMD Radeon Graphics driver - IOCTL granting arbitrary I/O port and physical memory accessHigh
• HPE OneView (command injection with local privilege escalation): A low-privileged local user on the OneView applianceCVE-2023-50274 · HPE OneView (command injection with local privilege escalation)High
• Linux kernel nfsd: NFSv4 compound decoding indexes the op table with OP_ILLEGAL, reading far out of boundsCVE-2023-53680 · Linux kernel NFS server (nfsd, nfsd4_decode_compound OPDESC indexing)High
• OpenVPN: Stack overflow in the interactive serviceCVE-2024-27459 · OpenVPNHigh
• Intel QuickAssist Technology (QAT) software and driversCVE-2024-31858 · Intel QuickAssist Technology (QAT) software and drivers - QAT software before 2.2.0, with a 2025 batch through 2.6.0High