Linux NFSD: use-after-free in the inter-server copy mount expiry walk

Impact

nfsd4_ssc_expire_umount() drops nfsd_ssc_lock to run mntput(), but the saved next pointer of its list walk is not pinned. Another nfsd thread whose source-server mount fails can free that exact entry in the window, so the expiry work then dereferences freed memory. This is kernel memory corruption inside the NFS server, reachable through ordinary NFSv4.2 server-to-server COPY traffic, and it lands in a kernel thread rather than a syscall context, so the likely outcome is a host crash or worse on a node that is also serving GPU jobs. The record carries no exploitation evidence; NVD's AV:N/PR:N 9.8 score reflects the remote-trigger path, not a demonstrated takeover. Only servers that export NFS and have inter-server copy in use are affected.

Who can reach it

A client that can reach the NFS server and drive NFSv4.2 inter-server COPY, plus concurrent failing source-server mounts. No local access needed; NFS-level authentication applies as configured on the export.

What to do

Take the stable-tree fix (the walk is restarted from the list head after the mntput window) and reboot each NFS server node. There is no runtime knob for the race itself; if you cannot reboot promptly, disabling NFSv4.2 inter-server copy on the export removes the code path. No fixed release number is stated in the record beyond the stable commits.

References

Related entries

• Linux kernel (drivers/pci/controller/dwc): A PCIe BAR window can end up larger than the memory actually backing it, soCVE-2024-58006 · Linux kernel (drivers/pci/controller/dwc)Critical
• Linux kernel (net/core, net/tls): The bitmap that marks sk_msg scatterlist entries as externally owned was not carriedCVE-2026-63830 · Linux kernel (net/core, net/tls)Critical
• Proxmox VE: unauthenticated API login bypass via arbitrary tfa-challenge yields root@pamCVE-2023-54391 · Proxmox VE libpve-access-control (API ticket endpoint, tfa-challenge)Critical
• VMware ESXi / Workstation / Fusion: Use-after-free in the XHCI USB controllerCVE-2024-22252 · VMware ESXi / Workstation / FusionCritical
• VMware ESXi / Workstation / Fusion: Use-after-free in the UHCI USB controllerCVE-2024-22253 · VMware ESXi / Workstation / FusionCritical
• VMware ESXi / Workstation: TOCTOU race leading to an out-of-bounds write in VMX - full VM escape to host code executionCVE-2025-22224 · VMware ESXi / WorkstationCritical