Linux kernel nfsd: use-after-free on the per-net file cache disposal queue during namespace teardown

Impact

The nfsd file cache defers fput() to nfsd service threads through a per-net queue held in a separately allocated struct that per-net teardown frees while the global shrinker, the laundrette worker and fsnotify callbacks can still be dereferencing it. The fix removes the separate allocation and inlines the lock and list into struct nfsd_net so their lifetime matches the namespace. On a node exporting NFS to a GPU fleet - a common pattern for dataset and checkpoint shares - this is memory corruption in the kernel on a host that many training jobs depend on, so the failure mode is a node that has to be taken out of service unplanned. NVD scores this AV:N/PR:N, but the described trigger is a race between namespace teardown and in-flight cache reclaim rather than a plain remote request; treat the network vector as unconfirmed.

Who can reach it

Requires the host to run knfsd. The race is between nfsd per-net teardown (an administrative or container-lifecycle action) and the global shrinker or fsnotify callbacks; the record does not establish an unauthenticated remote trigger.

What to do

Take the stable kernel carrying commit ba0ee9e04b7a (or the matching backport for your series) and reboot each affected NFS server node. No mitigation short of not running nfsd is described in the record.

References

Related entries

• Linux kernel qla2xxx: use-after-free when a late response interrupt reaches an already-freed request queueCVE-2026-89848 · Linux kernel qla2xxx (qpair teardown, response IRQ vs request queue free)High
• Linux kernel qla2xxx: virtual port used after vport_slock is dropped, allowing a use-after-freeCVE-2026-89861 · Linux kernel qla2xxx (qla24xx_report_id_acquisition vport reference)High
• Linux iommu/vt-d: context entry zeroed while Present, letting hardware fetch a torn entryCVE-2026-90243 · Linux kernel iommu/vt-d (copied context entry teardown ordering)High
• Linux kernel nfsd: unserialized grace_ended flag lets two contexts double-free every client reclaim recordCVE-2026-93221 · Linux kernel nfsd (nfsd_net grace_ended flag, nfsd4_end_grace race)High
• Apache MINA SSHD: a server requiring two public keys accepts the same key twice, a partial auth bypassCVE-2026-93994 · Apache MINA SSHD sshd-core (server-side multi-factor publickey authentication)High
• Linux kernel net/rds: teardown samples RDS_IN_XMIT instead of owning it, racing the transmit path into freed ring stateCVE-2026-98069 · Linux kernel net/rds (connection teardown vs transmit/refill fastpath locking)High