Linux nfsd: localio cmpxchg retry runs outside RCU, bumping a refcount on recycled memory

Impact

nfsd_file objects are freed via call_rcu into a slab created without SLAB_TYPESAFE_BY_RCU, so the backing page becomes reclaimable once the grace period elapses. The retry block in nfsd_open_local_fh() loads the pointer with cmpxchg and calls nfsd_file_get() without rcu_read_lock, and the sole caller drops the lock before entering. If nfsd_file_put_local() drops the last reference in parallel, the refcount_inc_not_zero can succeed against a recycled object and the caller then dereferences nf_net and nf_file out of freed memory. This affects hosts running the NFS client and server on the same node via the localio shortcut - a common pattern for converged storage nodes - and the failure is kernel memory corruption on that node.

Who can reach it

Local: requires NFS localio in use (client and server on the same host) and concurrent open/close activity on the same file handle. No remote path is described in the record.

What to do

Upgrade to a stable kernel with the referenced commits and reboot the affected node. Hosts that do not use NFS localio (client and server on different machines) do not run this code. The record gives commits only, no fixed release numbers.

References

Related entries

• Linux nfsd: NFSACL SETACL ignores the request mask and silently deletes the omitted ACLCVE-2026-89671 · Linux kernel nfsd (NFSACL v2/v3 SETACL mask handling)Unscored
• Linux nfsd: flexfiles GETDEVICEINFO over-reserves da_addr_body and leaks reply-page memoryCVE-2026-89673 · Linux kernel nfsd (pNFS flexfiles GETDEVICEINFO XDR encoder)Unscored
• Linux nfsd: flexfiles LAYOUTGET XDR size miscalculation writes past the reply bufferCVE-2026-89674 · Linux kernel nfsd (pNFS flexfiles LAYOUTGET XDR encoder)Unscored
• Linux nfsd: use-after-free when OFFLOAD_CANCEL or shutdown races the async COPY kthreadCVE-2026-89675 · Linux kernel nfsd (NFSv4.2 async server-side COPY teardown)Unscored
• Tenant handoff on bare metal: Reimaging the host disk clears nothing in the BMC, UEFI/SPI flash, NIC/DPU firmware, GPUNCVD-0000-013-tenant-handoff-on-bare-metal · Tenant handoff on bare metalUnscored
• ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platformsNCVD-2018-002-ecc-ddr3-server-memory-on-intel · ECC DDR3 server memory on Intel Xeon (Haswell, Sandy Bridge) and AMD Opteron platforms; the technique generalises to…Unscored