Linux nfsd: FREE_STATEID on an admin-revoked delegation leaves it on cl_revoked as freed memory

Impact

nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but does not set SC_STATUS_FREED before dropping cl_lock. revoke_delegation() relies on that flag to know FREE_STATEID already processed the delegation, so without it the freed delegation is list_add()ed to cl_revoked and __destroy_client() later walks that list into freed memory - a use-after-free at client teardown. Reaching it needs an administrative delegation revoke plus a client FREE_STATEID, which is a narrower window than the other nfsd bugs in this batch, but the payoff is kernel memory corruption on the storage server the fleet depends on.

Who can reach it

An NFSv4 client issuing FREE_STATEID for a delegation that has been administratively revoked on the server. Ordinary client authentication plus an admin revoke having occurred.

What to do

Update the NFS server kernel to include one of the linked stable commits and reboot the server. There is no workaround beyond avoiding administrative delegation revokes on an unpatched server.

References

Related entries

• Linux nfsd: use-after-free on cl_cb_session when a session is destroyed with a callback in flightCVE-2026-89708 · Linux NFS server (nfsd callback client, cl_cb_session lifetime on DESTROY_SESSION)Critical
• Intel Data Center Manager SDK (reference UI): The DCM SDK's reference UI allows an unauthenticated remote attackerCVE-2018-3679 · Intel Data Center Manager SDK (reference UI)Critical
• BeeGFS (beegfs-ctl / metadata server): Authentication bypass by talking directly to a BeeGFS metadata server. BeeGFS isCVE-2019-15897 · BeeGFS (beegfs-ctl / metadata server)Critical
• Dell OpenManage Enterprise (remote code execution): Remote code execution on the OpenManage Enterprise consoleCVE-2021-21596 · Dell OpenManage Enterprise (remote code execution)Critical
• Tailscale (Windows client): Local API bound to a TCP socketCVE-2022-41924 · Tailscale (Windows client)Critical
• GitLab: Attacker can trigger a CI pipeline as another userCVE-2024-6385 · GitLabCritical