Linux kernel SUNRPC: nfsd request buffers freed before the RCU grace period, causing a use-after-free

Impact

svc_rqst_free() freed rq_argp and rq_resp synchronously while deferring the rqstp struct itself to kfree_rcu. RCU readers that began before the thread was unlinked - for example the nfsd rpc_status netlink dump - can still find the rqstp and dereference buffers that are already gone. On a node exporting NFS (a shared dataset or checkpoint server in a GPU fleet), this is a host-kernel use-after-free triggered by ordinary nfsd thread teardown racing a status read, which is exactly the kind of thing that fires during a routine nfsd thread-count change.

Who can reach it

Local and privileged: a reader of the nfsd rpc_status interface racing nfsd thread shutdown. Not reachable from an NFS client over the wire.

What to do

Update to a stable kernel that moves the rq_argp and rq_resp frees into the call_rcu callback (commits in the record). No mitigation short of avoiding nfsd thread-count changes while status is being read. Requires draining and rebooting the NFS-serving nodes.

References

Related entries

• Linux kernel NFS: backchannel request racing callback shutdown leaks transport refs or queues onto a freed svc_servCVE-2026-89546 · Linux kernel SUNRPC/NFS backchannel (xprt_enqueue_bc_request, callback service teardown)Unscored
• Linux kernel SUNRPC: use-after-free when a network namespace tears down an RPC cacheCVE-2026-89548 · Linux kernel SUNRPC (per-netns cache_detail teardown)Unscored
• Linux kernel nfsd: undersized Kerberos token reaches the krb5 unwrap core and divides by zeroCVE-2026-89550 · Linux kernel SUNRPC svcauth_gss (krb5 token length validation)Unscored
• Linux kernel SUNRPC: xdr_buf_trim underflows buf->len, handing XDR decoders a near-UINT_MAX boundCVE-2026-89551 · Linux kernel SUNRPC xdr_buf_trim (buf->len underflow)Unscored
• Linux kernel CXL: MCE notifier outlives its memory device, giving NULL deref and use-after-freeCVE-2026-89570 · Linux kernel CXL MCE notifier (per-memdev registration lifetime)Unscored
• Linux kernel CXL fwctl: unchecked op_size reads past the input buffer and into the device mailboxCVE-2026-89571 · Linux kernel CXL features fwctl (cxlctl_fw_rpc op_size validation)Unscored