Linux NFS server (nfsd, laundromat vs free_stateid race): A race between the delegation laundromat and a client-issued

Impact

A race between the delegation laundromat and a client-issued FREE_STATEID gives a use-after-free in nfsd. A tenant that can time FREE_STATEID against delegation expiry crashes the file server, and a UAF of this shape is a plausible escalation primitive on the storage node.

Who can reach it

Any NFSv4 client that can reach the server and hold a delegation - so any tenant compute node with the export mounted.

What to do

Update the storage server kernel to one carrying the fix and reboot. Disabling delegations (echo 0 > /proc/fs/nfsd/... or the leasetime knob) narrows the window but is not a fix.

References