Linux kernel nfsd: use-after-free when writing v4_end_grace races with server shutdown

Impact

Writing to the nfsd v4_end_grace control file can race with NFS server shutdown, freeing and then accessing nfsd state - reclaim_str_hashtbl in particular. The fix adds a client_tracking_active flag under nn->client_lock so the laundromat work item is never rescheduled after shutdown has waited for it. On a GPU fleet this lands on the NFS servers that export home directories, datasets and checkpoints: a crash there stalls every training job holding an open file. The trigger requires writing to a privileged nfsd control file, so this is an operational-stability and local-root-adjacent bug rather than something a tenant reaches.

Who can reach it

Local and privileged on the NFS server: a process able to write /proc/fs/nfsd/v4_end_grace (root, or the nfsdcltrack upcall path) while nfsd is being shut down. Not reachable from NFS clients or tenant pods.

What to do

Update the NFS server kernel to a build with the nfsd v4_end_grace locking fix (commits in the record) and reboot the server, which for a single-homed NFS export means a storage outage window for every job mounting it. Until patched, avoid scripting v4_end_grace writes around nfsd restarts. The record names no fixed release beyond the listed commits.

References

Related entries

• Linux kernel iSCSI target: use-after-free on session teardown when complete() is called under the lockCVE-2026-23193 · Linux kernel iSCSI target (iscsit_dec_session_usage_count)High
• Linux kernel iSCSI target: use-after-free on connection close when complete() is called under the lockCVE-2026-23216 · Linux kernel iSCSI target (iscsit_dec_conn_usage_count)High
• MUNGE (munged credential daemon): This is the root of trust under Slurm. A crafted message with an oversizedCVE-2026-25506 · MUNGE (munged credential daemon)High
• Linux kernel ceph client: uninitialized ceph_path_info leads to freeing an object from the wrong slab cacheCVE-2026-43408 · Linux kernel CephFS client (ceph_path_info initializers)High
• VMware Avi Load Balancer: local user can escalate to root on the applianceCVE-2026-47868 · VMware Avi Load Balancer (Controller and Service Engine appliance)High
• Linuxfabrik monitoring plugins: pipe injection in shell_exec escalates a check account to rootCVE-2026-55426 · Linuxfabrik Monitoring Plugins / linuxfabrik-lib (lib.shell.shell_exec)High