Linux NFSD: filecache shutdown race leaks nfsd_file objects and their state

Impact

The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsd_file and then queue it to the per-net dispose list. If nfsd_file_cache_shutdown_net() runs concurrently, its rhashtable walk misses the unhashed file and its drain can run before the file is queued, so the file is left on a list nobody will drain. The result is a permanent leak of the file and its associated state on every affected net-namespace teardown - relevant to nodes that start and stop containerized NFS servers, where repeated teardowns accumulate unreclaimable kernel memory until reboot. Triggering it requires winning a race against shutdown; the record shows no path to memory corruption or privilege gain.

Who can reach it

Requires NFS server activity concurrent with a per-net nfsd shutdown, i.e. a local administrator or orchestration layer that stops nfsd in a network namespace while clients are still driving file cache churn. Not a path an unauthenticated remote client controls on its own.

What to do

Apply the stable fix, which widens nfsd_gc_lock over the dispose-list handoff in all three callers and adds a lock barrier in shutdown_net, then reboot the node. Until then, memory lost to the leak is only reclaimed by a reboot. The record names stable commits, not a released version.

References

Related entries

• Linux kernel nfsd: use-after-free on the per-net file cache disposal queue during namespace teardownCVE-2026-89682 · Linux kernel nfsd (file cache delayed disposal, nfsd_fcache_disposal)High
• Linux kernel qla2xxx: use-after-free when a late response interrupt reaches an already-freed request queueCVE-2026-89848 · Linux kernel qla2xxx (qpair teardown, response IRQ vs request queue free)High
• Linux kernel qla2xxx: virtual port used after vport_slock is dropped, allowing a use-after-freeCVE-2026-89861 · Linux kernel qla2xxx (qla24xx_report_id_acquisition vport reference)High
• Linux iommu/vt-d: context entry zeroed while Present, letting hardware fetch a torn entryCVE-2026-90243 · Linux kernel iommu/vt-d (copied context entry teardown ordering)High
• Linux kernel nfsd: unserialized grace_ended flag lets two contexts double-free every client reclaim recordCVE-2026-93221 · Linux kernel nfsd (nfsd_net grace_ended flag, nfsd4_end_grace race)High
• Apache MINA SSHD: a server requiring two public keys accepts the same key twice, a partial auth bypassCVE-2026-93994 · Apache MINA SSHD sshd-core (server-side multi-factor publickey authentication)High