Linux kernel nfsd: racing FREE_STATEID calls cause use-after-free or refcount underflow

Impact

nfsd4_free_stateid() finds a delegation stateid under the client lock but drops that lock before calling nfs4_put_stid(), so a second FREE_STATEID for the same stateid can find it again. The first caller then frees it, giving either a use-after-free or a decrement of an already-zero refcount. For operators this matters on the nodes that export NFS to the fleet - a shared dataset or home-directory server, or an in-kernel NFS export on a storage head. A client that is already permitted to mount can crash the export, which stalls every training job reading from it, and a kernel use-after-free in nfsd carries the usual risk of worse than a crash. Only the kernel NFS server is affected; clients are not.

Who can reach it

An authenticated NFSv4 client - anything already allowed to mount the export - sending multiple FREE_STATEID operations for the same delegation stateid. No local account on the server is needed, but the attacker must be inside whatever your export policy admits.

What to do

Update to a stable kernel carrying commits 7ca9e472ce5c and c88c150a467f on every host that runs the in-kernel NFS server, then reboot it (restarting nfs-server is not enough - the code is in the kernel). A node that exports shared storage usually cannot be drained cheaply, so plan the reboot with the dependent jobs in mind. Hosts that only mount NFS need no action.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): The observation/OA path reuses one batch buffer and appends a batch-end command onCVE-2024-50090 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/iommu/intel): VT-d walked the PCI DMA-alias list for devices that are not PCI at all whileCVE-2024-50101 · Linux kernel (drivers/iommu/intel)High
• Linux kernel (drivers/gpu/drm/xe): Xe freed a job from inside timeout-detection-and-recovery while the submissionCVE-2024-50149 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel cxl/port: use-after-free when CXL region decoders are torn down out of orderCVE-2024-50226 · Linux kernel CXL port driver (out-of-order switch decoder shutdown)High
• Linux kernel sunrpc: use-after-free when a network namespace is destroyed with an NFS TCP socket still armedCVE-2024-53168 · Linux kernel sunrpc (NFS client TCP socket lifetime vs. network namespace teardown)High
• Linux kernel (drivers/vfio/pci): Out-of-bounds read past the ecap_perms table when a tenant touches emulated PCIeCVE-2024-53214 · Linux kernel (drivers/vfio/pci)High