Linux kernel nfsd: module init error path leaves debugfs files pointing into freed module text

Impact

In init_nfsd(), nfsd_debugfs_init() ran before nfsd4_init_slabs(). If the slab allocation failed, the bare error return skipped nfsd_debugfs_exit(), leaving debugfs entries whose file operations point into module text that is about to be freed - a use-after-free if anyone later touches those files. The fix moves debugfs setup after slab init and makes the unwind paths strictly LIFO. Real exposure on a storage or head node exporting NFS is very low: it requires the nfsd module load itself to fail on memory allocation, and then local access to debugfs, which is root-only and often not mounted. The 7.8 score reflects the generic local-code-execution template kernel CVEs receive, not a demonstrated path here.

Who can reach it

Local only, and only after a failed nfsd module load under memory pressure. Reaching the stale files requires root (or an equivalently privileged user) on the host, since debugfs is mounted 0700 and frequently absent on production servers. Not reachable by an NFS client over the network.

What to do

Pick up the fix in your distribution's next stable kernel; there is no userspace mitigation and no configuration change that removes the ordering bug. Applying it means a kernel package update and a reboot of each NFS server, which on a storage head node means a planned failover. Given how narrow the trigger is, this is routine-cycle work rather than an emergency window.

References

Related entries

• CyberPower PowerPanel managed devices - shared device certificates: Every managed device uses an identical certificateCVE-2024-31410 · CyberPower PowerPanel managed devices - shared device certificatesHigh
• Keycloak: SAML signature scope determined by position, not ReferenceCVE-2024-8698 · KeycloakHigh
• Tridium Niagara Framework and Niagara Enterprise Security (before 4.10.11 / 4.14.2 / 4.15.1): A chain, not a singleCVE-2025-3937 · Tridium Niagara Framework and Niagara Enterprise Security (before 4.10.11 / 4.14.2 / 4.15.1)High
• GitLab CE/EE: environment scope matching lets an authenticated user read CI/CD variables outside their scopeCVE-2026-13210 · GitLab CE/EE (CI/CD environment scope pattern matcher)High
• BOSH vSphere CPI: missing certificate pinning lets an interceptor impersonate vCenter and capture admin credentialsCVE-2026-41012 · BOSH Director vSphere CPI (vCenter REST API certificate validation)High
• OpenTelemetry Operator TargetAllocator: a tenant ServiceMonitor can exfiltrate the Collector's service-account tokenCVE-2026-47701 · OpenTelemetry Operator TargetAllocator (ServiceMonitor bearerTokenFile handling)High