Linux NFSD: filecache shutdown race leaks nfsd_file objects and their state

Impact

The shrinker, GC worker, and fsnotify/lease callbacks can unhash an nfsd_file and then queue it to the per-net dispose list. If nfsd_file_cache_shutdown_net() runs concurrently, its rhashtable walk misses the unhashed file and its drain can run before the file is queued, so the file is left on a list nobody will drain. The result is a permanent leak of the file and its associated state on every affected net-namespace teardown - relevant to nodes that start and stop containerized NFS servers, where repeated teardowns accumulate unreclaimable kernel memory until reboot. Triggering it requires winning a race against shutdown; the record shows no path to memory corruption or privilege gain.

Who can reach it

Requires NFS server activity concurrent with a per-net nfsd shutdown, i.e. a local administrator or orchestration layer that stops nfsd in a network namespace while clients are still driving file cache churn. Not a path an unauthenticated remote client controls on its own.

What to do

Apply the stable fix, which widens nfsd_gc_lock over the dispose-list handoff in all three callers and adds a lock barrier in shutdown_net, then reboot the node. Until then, memory lost to the leak is only reclaimed by a reboot. The record names stable commits, not a released version.

References

Related entries

• Linux kernel nfsd: use-after-free on the per-net file cache disposal queue during namespace teardownCVE-2026-89682 · Linux kernel nfsd (file cache delayed disposal, nfsd_fcache_disposal)High
• Linux kernel (virt/kvm): The dirty-ring reset path bounds-checks an offset with unchecked 64-bit arithmetic, so aCVE-2026-52969 · Linux kernel (virt/kvm)High
• Linux kernel (arch/x86/kvm/svm): VMLOAD/VMSAVE executed by an L2 guest and not intercepted by L1 were emulated againstCVE-2026-43133 · Linux kernel (arch/x86/kvm/svm)High
• util-linux nsenter: --join-cgroup leaks a root-opened cgroup.procs fd into the target containerCVE-2026-78408 · util-linux nsenter (--join-cgroup descriptor leak across execve)High
• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh
• Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping failsCVE-2014-3601 · Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pagesHigh