Linux kernel nfsd: use-after-free on the per-net file cache disposal queue during namespace teardown

Impact

The nfsd file cache defers fput() to nfsd service threads through a per-net queue held in a separately allocated struct that per-net teardown frees while the global shrinker, the laundrette worker and fsnotify callbacks can still be dereferencing it. The fix removes the separate allocation and inlines the lock and list into struct nfsd_net so their lifetime matches the namespace. On a node exporting NFS to a GPU fleet - a common pattern for dataset and checkpoint shares - this is memory corruption in the kernel on a host that many training jobs depend on, so the failure mode is a node that has to be taken out of service unplanned. NVD scores this AV:N/PR:N, but the described trigger is a race between namespace teardown and in-flight cache reclaim rather than a plain remote request; treat the network vector as unconfirmed.

Who can reach it

Requires the host to run knfsd. The race is between nfsd per-net teardown (an administrative or container-lifecycle action) and the global shrinker or fsnotify callbacks; the record does not establish an unauthenticated remote trigger.

What to do

Take the stable kernel carrying commit ba0ee9e04b7a (or the matching backport for your series) and reboot each affected NFS server node. No mitigation short of not running nfsd is described in the record.

References

Related entries

• Linux kernel (virt/kvm): The dirty-ring reset path bounds-checks an offset with unchecked 64-bit arithmetic, so aCVE-2026-52969 · Linux kernel (virt/kvm)High
• Linux kernel (arch/x86/kvm/svm): VMLOAD/VMSAVE executed by an L2 guest and not intercepted by L1 were emulated againstCVE-2026-43133 · Linux kernel (arch/x86/kvm/svm)High
• util-linux nsenter: --join-cgroup leaks a root-opened cgroup.procs fd into the target containerCVE-2026-78408 · util-linux nsenter (--join-cgroup descriptor leak across execve)High
• Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - theCVE-2010-3904 · Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_userHigh
• Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pages: When an IOMMU mapping failsCVE-2014-3601 · Linux kernel KVM device assignment IOMMU path virt/kvm/iommu.c - kvm_iommu_map_pagesHigh
• ABRT: symlink attack on predictable core-dump paths gives local users root on RHEL hostsCVE-2015-5287 · ABRT abrt-hook-ccpp (core dump helper on RHEL/CentOS)High