Linux kernel SUNRPC: double free of xprt_ctxt when a request is deferred twice

Impact

svc_defer() failed to clear rq_xprt_ctxt when reusing an existing svc_deferred_req, so a request deferred a second time could have its transport context freed twice - freed outright on UDP, returned to a free list on RDMA - and then referenced again when the deferral is revisited. The practical effect is a kernel oops, and on RDMA a context handed back out while still in use. This is server-side NFS/SUNRPC, so it matters on nodes exporting NFS, including NFS-over-RDMA exports in front of GPU training jobs, where a crash drops the share for every client at once. The commit message itself calls the double-deferral path rare.

Who can reach it

Reachable by NFS clients of an affected server: a client whose requests get deferred twice under load. Exposure is bounded by who can mount or reach the RPC service, not by credentials on the server.

What to do

Patch to a stable kernel containing the svc_defer() fix (commits listed in the record) and reboot the exporting node; failing over or draining NFS clients first avoids an abrupt outage. No configuration workaround is documented; restricting NFS exports to the storage VLAN limits who can reach the service.

References

Related entries

• Linux kernel (net/tls): The async decrypt completion released pages that the decrypt path never took a reference on, soCVE-2024-26582 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): The thread in recvmsg/sendmsg can exit as soon as the async crypto callback signals completionCVE-2024-26583 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): When the crypto queue is full the AEAD call returns -EBUSY instead of -EINPROGRESS and theCVE-2024-26584 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): The async crypto callback signalled completion before scheduling the transmit work, so theCVE-2024-26585 · Linux kernel (net/tls)Critical
• Linux kernel (net/tls): When a decrypt goes to the crypto backlog and a sibling decrypt fails, the error path releasesCVE-2024-26800 · Linux kernel (net/tls)Critical
• VMware vCenter: Heap overflow in the DCERPC implementation - unauthenticated remote code execution on vCenterCVE-2024-37079 · VMware vCenterCritical