Linux nfsd: use-after-free on cl_cb_session when a session is destroyed with a callback in flight

Impact

After DESTROY_SESSION the teardown path can kfree a session while an rpc_task on rpciod still dereferences clp->cl_cb_session. Flushing cl_callback_wq does not wait for a task already handed to rpc_call_async(), and rpc_shutdown_client() only drains with a one-second timeout, which a task sitting in a two-second NFS4ERR_DELAY rpc_delay() outlives. A second window exists in nfsd4_process_cb_update(), where cl_cb_session retains a pointer to the about-to-be-freed session because the v4.1 early return skips the assignment. Either way rpciod reads freed slab memory on the NFS server, giving a client that controls its callback timing a path to corrupt or crash shared storage for every node that mounts the export.

Who can reach it

An NFSv4.1 client that can establish a backchannel, stall callbacks with NFS4ERR_DELAY, and then send DESTROY_SESSION. Ordinary client authentication to the export.

What to do

Patch the NFS server kernel with one of the linked stable commits and reboot; the fix makes cl_cb_session an __rcu pointer, publishes it only after rpc_create() succeeds, and frees sessions with kfree_rcu(). nfsd is in-kernel, so a service restart does not apply the fix and there is no configuration mitigation.

References

Related entries

• Intel Data Center Manager SDK (reference UI): The DCM SDK's reference UI allows an unauthenticated remote attackerCVE-2018-3679 · Intel Data Center Manager SDK (reference UI)Critical
• BeeGFS (beegfs-ctl / metadata server): Authentication bypass by talking directly to a BeeGFS metadata server. BeeGFS isCVE-2019-15897 · BeeGFS (beegfs-ctl / metadata server)Critical
• Dell OpenManage Enterprise (remote code execution): Remote code execution on the OpenManage Enterprise consoleCVE-2021-21596 · Dell OpenManage Enterprise (remote code execution)Critical
• Tailscale (Windows client): Local API bound to a TCP socketCVE-2022-41924 · Tailscale (Windows client)Critical
• GitLab: Attacker can trigger a CI pipeline as another userCVE-2024-6385 · GitLabCritical
• AAP Controller: testing a Vault credential sends the controller pod's service account token to an attacker URLCVE-2026-12564 · Red Hat Ansible Automation Platform Controller (awx_plugins HashiCorp Vault credential plugin)Critical