Linux nfsd: writing unlock_filesystem after server shutdown walks freed state tables (use-after-free)

Impact

Writing a filesystem path to /proc/fs/nfsd/unlock_filesystem runs nfsd4_cancel_copy_by_sb() before nfsd_mutex is held and before the handler confirms nn->nfsd_serv is set. After nfsd has shut down, nfs4_state_destroy_net() has freed nn->conf_id_hashtbl but left the pointer, so the helper iterates freed slab memory as list heads and then takes clp->async_lock on a bogus nfs4_client; KASAN reports a slab-use-after-free read. A local administrator with CAP_SYS_ADMIN reaches it by stopping the server and then writing to the file - so this is an admin-triggered crash of a storage or head node rather than a privilege boundary an unprivileged tenant can cross. Worth patching on any node that exports NFS to the fleet, but it does not warrant an emergency window on its own.

Who can reach it

Local administrator holding CAP_SYS_ADMIN on the NFS server host, writing to /proc/fs/nfsd/unlock_filesystem after nfsd has been stopped. No tenant or network path.

What to do

Update the NFS server host to a stable kernel carrying the fix (two backport commits linked on the record); the fix moves the async COPY cancel inside the section already guarded by nfsd_mutex with nn->nfsd_serv confirmed present. Remediation is a reboot of the server node - batch it with the other nfsd fixes from the same day. Until then, do not write to unlock_filesystem while nfsd is stopped.

References

Related entries

• Linux nfsd: lock owner freed by the laundromat while client teardown walks it, causing a NULL dereferenceCVE-2026-89662 · Linux NFS server (nfsd, __destroy_client lock-owner teardown / remove_blocked_locks)Unscored
• Linux nfsd: copy-notify stateid freed while still discoverable, a use-after-free on all three revoke pathsCVE-2026-89663 · Linux NFS server (nfsd, copy-notify stateids in s2s_cp_stateids / _free_cpntf_state_locked)Unscored
• Linux nfsd: POSIX ACL refs leak on every malformed NFSv4 OPEN compoundCVE-2026-89664 · Linux kernel nfsd (NFSv4 OPEN compound POSIX ACL release)Unscored
• Linux nfsd: unvalidated NFSv3 nseconds corrupts on-disk timestamps on ext4 and XFSCVE-2026-89666 · Linux kernel nfsd (NFSv3 SETATTR/CREATE timestamp validation)Unscored
• Linux nfsd: copy-notify stateid published before initialisation, freeable by a racing OFFLOAD_CANCELCVE-2026-89669 · Linux kernel nfsd (NFSv4.2 COPY_NOTIFY stateid)Unscored
• Linux nfsd: localio cmpxchg retry runs outside RCU, bumping a refcount on recycled memoryCVE-2026-89670 · Linux kernel nfsd (localio nfsd_open_local_fh)Unscored