Linux kernel nfsd: use-after-free and RCU-context sleep when reading the export cache

CVSS 7.8CVE-2024-53216Kernel, userspace & hypervisorcurated

Impact

The last reference to an nfsd export or export-key cache entry can be dropped from inside the procfs show handlers while they still hold an RCU read-side lock. The handler then reads ex_uuid after it has been freed (KASAN slab-use-after-free in svc_export_show) and path_put() sleeps in an atomic context. On a node that exports NFS - a storage head or a GPU node re-exporting a dataset mount - the practical outcome is a kernel crash or memory corruption while the export cache is being torn down, which takes the export and every client with it. Reaching it needs the nfsd procfs cache files, so this is a privileged-local or root-triggered stability bug rather than a tenant escalation path.

Who can reach it

Local, on a host running the in-kernel NFS server. The trigger is a read of the nfsd export cache files under /proc while the cache is being purged (for example a thread-count write that destroys the server), which is root-only in a default configuration. Not reachable from an unprivileged container or over the network.

What to do

Patch the kernel to a stable release carrying the rcu_work-based release of svc_export and svc_expkey, then reboot. Hosts that do not run the in-kernel nfsd (no nfsd module loaded) are not exposed and can take the fix on their normal kernel cadence. No vendor mitigation is published; unloading or not using nfsd removes the path.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-53216 https://git.kernel.org/stable/c/2e4854599200f4d021df8ae17e69221d7c149f3e https://git.kernel.org/stable/c/a98fa661769edacd3bf319c4a150f00bea61945b https://git.kernel.org/stable/c/f8c989a0c89a75d30f899a7cabdc14d72522bb8d

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.