Linux nfsd: session slot shrinker frees the slot in use, corrupting the slab with reply data

Impact

The session shrink path never checked the current request's slotid against se_target_maxslots, so a client using a slot above the shrink boundary can satisfy every guard and have free_session_slots() kfree the slot it is being served on. nfsd then keeps writing sl_seqid, sl_flags and sl_generation to freed memory, stores the dangling pointer in cstate->slot, and nfsd4_store_cache_entry() later copies up to maxresp_cached bytes of the compound reply into the freed sl_data[] - a client-controlled write into whatever slab object now occupies that address. The shrinker can also free a high-numbered slot out from under a concurrent SEQUENCE because NFSD4_SLOT_INUSE was not consulted. This is the strongest of the nfsd bugs in this batch: a controlled heap write from an authenticated client against the storage server the whole cluster mounts.

Who can reach it

An NFSv4.1/4.2 client that can mount the export and choose its slot id, once the session shrinker has reduced the target slot count under memory pressure. Ordinary client authentication; no server-side privilege.

What to do

Patch the NFS server kernel with one of the linked stable commits and reboot the server - the fix bounds the caller's slotid and defers the shrink when any slot in the range is NFSD4_SLOT_INUSE. Treat this one as the reason to open the window rather than waiting for the next routine kernel roll; there is no supported way to disable the session shrinker.

References

Related entries

• Linux nfsd: fh_verify tracepoints size the server address slot wrongly, writing past the trace bufferCVE-2026-89702 · Linux NFS server (nfsd_fh_verify tracepoints, server sockaddr slot sizing)Critical
• Linux nfsd: FREE_STATEID on an admin-revoked delegation leaves it on cl_revoked as freed memoryCVE-2026-89703 · Linux NFS server (nfsd4_drop_revoked_stid, SC_STATUS_FREED on delegations)Critical
• Linux nfsd: use-after-free on cl_cb_session when a session is destroyed with a callback in flightCVE-2026-89708 · Linux NFS server (nfsd callback client, cl_cb_session lifetime on DESTROY_SESSION)Critical
• Intel Data Center Manager SDK (reference UI): The DCM SDK's reference UI allows an unauthenticated remote attackerCVE-2018-3679 · Intel Data Center Manager SDK (reference UI)Critical
• BeeGFS (beegfs-ctl / metadata server): Authentication bypass by talking directly to a BeeGFS metadata server. BeeGFS isCVE-2019-15897 · BeeGFS (beegfs-ctl / metadata server)Critical
• Dell OpenManage Enterprise (remote code execution): Remote code execution on the OpenManage Enterprise consoleCVE-2021-21596 · Dell OpenManage Enterprise (remote code execution)Critical