Linux kernel (nfsd) vulnerabilities

In the Linux kernel, the nfsd module failed to reset the write verifier when an async COPY writeback failed. When writeback failed, the server reported NFS_UNSTABLE to the NFS client but did not rotate the verifier, so after COMMIT the client treated the data as durable even though the write had failed.

In the Linux kernel, nfsd_dispatch() did not restore rq_status_counter to an even value on all exit paths (cache-hit, drop, encode-error). The counter left odd caused the lockless reader in nfsd_nl_rpc_status_get_dumpit() to treat rqstp fields as stable and read past the end of the 8-element ops array.

In the Linux kernel, _nfsd_copy_file_range() sampled the writeback error cursor (dst->f_wb_err) after the copy loop instead of before it. Concurrent COMMIT or stable WRITE could advance the cursor, so the writeback error went undetected and NFSD4_COPY_F_COMMITTED was set despite the failed write.

In the Linux kernel, nfsd4_drop_revoked_stid(), which handles FREE_STATEID for admin-revoked delegations, did not set SC_STATUS_FREED before releasing cl_lock. Without this flag the freed delegation was added to cl_revoked, causing a use-after-free when that list is later traversed in __destroy_client().

In the Linux kernel, the xdrgen-based TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode arms stored a raw uint32_t nseconds directly into tv_nsec without enforcing nseconds < NSEC_PER_SEC. A malicious client could send a malformed timespec that propagated through notify_change() to disk.

In the Linux kernel, the nfsd_sock_nl_policy declared NFSD_A_SOCK_ADDR as a bare NLA_BINARY attribute with no minimum length. A CAP_NET_ADMIN caller could send a 16-byte address with sa_family=AF_INET6, causing a 12-byte out-of-bounds read across three consumers (rpc_cmp_addr_port, svc_find_listener, kernel_bind).

In the Linux kernel, nfsd4_decode_create() accepted an unbounded cr_datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size (several MiB) per COMPOUND op. The VFS rejected oversized targets with ENAMETOOLONG, but the allocation had already occurred.

In the Linux kernel, struct nfsd_genl_rqstp declared rq_daddr and rq_saddr as plain struct sockaddr (16 bytes). With an IPv6 NFS client connected, nfsd_genl_rpc_status_compose_msg() cast these fields to struct sockaddr_in6 (28 bytes), reading 8 bytes past the field and shipping a truncated IPv6 address plus part of rq_flags to userspace via netlink.

In the Linux kernel, the BOTH_TIME_SET branch in nfsd_proc_setattr() called fh_verify() early so setattr_prepare() could inspect the dentry. This caused nfsd_setattr() to skip fh_want_write(), so notify_change() ran without a mount write reference.

In the Linux kernel's nfsd module, a flaw allows subsequent operations to run after a FOREIGN PUTFH even when fh_dentry is NULL. A remote NFSv4.2 client can craft a COMPOUND request that triggers a NULL pointer dereference in the nfsd kernel thread. The issue affects configurations with CONFIG_NFSD_V4_2_INTER_SSC enabled.

In the Linux kernel's nfsd module, nfsd4_decode_posixacl() accepts an unbounded ACL entry count from the client and passes it to an O(n^2) bubble sort. A client can choose an arbitrarily large value, causing excessive CPU consumption on the server. The symmetric NFS_ACL_MAX_ENTRIES check present on the encoder side is missing in the decoder.

In the Linux kernel's nfsd module, manage_cpntf_state() on the OFFLOAD_CANCEL path freed a copy-notify state without checking ownership. The lookup key is predictable and the embedded clientid is fixed per network, so any authenticated NFSv4.2 client could cancel and free another client's copy-notify stateid. The fix compares the creating clientid against the requesting client's clientid and returns nfserr_bad_stateid on mismatch.

In the Linux kernel's nfsd module, nfsd4_create() stores the return value of nfsd4_acl_to_attr() in status, but the switch(create->cr_type) block unconditionally overwrites it in every branch. ACL translation errors are silently discarded, and the CREATE succeeds without the requested ACL. The fix adds an early exit check, matching the pattern used in nfsd4_setattr().

In the Linux kernel's nfsd module, nfsd_break_one_deleg() sets the NFSD4_CALLBACK_RUNNING bit, but when the recall queue attempt fails, the bit is not cleared. This permanently latches the bit, causing subsequent break_lease() calls on the same delegation to silently skip the recall, so the delegation is never broken and conflicting opens or locks stall. The fix clears the bit on the !queued branch.

In the Linux kernel's nfsd module, nfsd4_release_compoundargs() resets args->ops to the inline iops[8] array but leaves args->opcnt at its original value (up to 200 for NFSv4.1+). When rq_status_counter is stuck at an odd value, the dumpit handler reads up to 16 entries from args->ops[], reading past the array and leaking adjacent slab memory to userspace via netlink. The fix zeroes opcnt unconditionally.

In the Linux kernel's nfsd module, the args->ops buffer is freed synchronously via vfree() in nfsd4_release_compoundargs(), while the rpc_status netlink dumpit handler reads that buffer under rcu_read_lock. A concurrent compound completion can free the buffer while it is being read, causing a use-after-free on vmalloc memory. The fix replaces vfree() with kvfree_rcu_mightsleep(), deferring the free across an RCU grace period.

A use-after-free vulnerability was found in the Linux kernel nfsd module within nfsd4_sequence(). When the session shrinker reduces se_target_maxslots below se_fchannel.maxreqs, free_session_slots() may free the slot currently being processed because it does not check seq->slotid or the NFSD4_SLOT_INUSE flag. This leads to memory corruption via writes into the freed sl_data[] buffer.

In the Linux kernel's nfsd module, nfs4_preprocess_seqid_op() on an -EAGAIN error from nfsd4_cstate_assign_replay() dropped a stateowner reference it never acquired, while leaking the stid reference. This risks a stateowner refcount underflow and use-after-free, and can stall a concurrent nfsd4_close_open_stateid(). The fix drops the stid reference before retrying.

In the Linux kernel's nfsd module, nfsd_file_do_acquire() could use a file returned by dentry_create() that was not actually opened, because ->atomic_open may return success via finish_no_open(). The scenario is extremely unlikely, but the fix requires nfsd to use the file only when FMODE_OPENED is set.

In the Linux kernel, nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding fi_lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering BUG_ON. The race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall.

In the Linux kernel, clients_still_reclaiming() computes a deadline from nn->boot_time (CLOCK_REALTIME) but compares it against ktime_get_boottime_seconds() (CLOCK_BOOTTIME), so the comparison is always false. As a result, any client can hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests, blocking all non-reclaim operations for all other clients.

In the Linux kernel, nfs4_alloc_init_cpntf_state() published the new cpntf entry into the s2s_cp_stateids IDR in one s2s_cp_lock section, then took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap the entry was reachable by so_id but cp_list was still zeroed, allowing a racing OFFLOAD_CANCEL to call list_del() on the zeroed list_head and oops the server.

In the Linux kernel, nfsd_set_fh_dentry() leaks the dentry reference from exportfs_decode_fh_raw() when the NFS3_FHSIZE or NFS_FHSIZE switch cases detect NFSEXP_V4ROOT and goto out. The out label calls exp_put() but never dput(dentry), and fhp->fh_dentry was never assigned so fh_put() cannot compensate. A crafted NFSv3 filehandle targeting a V4ROOT export's fsid triggers the leak on every request.

In the Linux kernel, nfsd_file_dispose_list_delayed() defers fput() to nfsd service threads via a per-net freeme queue that lives in a separately-allocated struct nfsd_fcache_disposal freed during per-net teardown. The global shrinker, laundrette, and fsnotify callbacks can still dereference that pointer, causing a use-after-free.

In the Linux kernel, the workqueue core clears WORK_STRUCT_PENDING before the callback is invoked, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc_count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid.

In the Linux kernel, a race condition exists in the nfsd module between the shrinker, GC worker, and fsnotify/lease callbacks versus per-net shutdown in the filecache. An nfsd_file can be unhashed and moved to the dispose list before nfsd_file_cache_shutdown_net() processes it, causing a leak of the file and its associated state. The fix widens the nfsd_gc_lock scope across all three callers of nfsd_file_dispose_list_delayed() and adds a spinlock barrier in the per-net shutdown function.

A memory (reference) leak of posix_acl objects exists in the nfsd module of the Linux kernel. When an NFS client sends a malformed OPEN operation carrying POSIX ACL attributes, nfsd4_open() is never invoked, so the allocated posix_acl structures are not released. The issue also affects the v4.0 replay path.

The NFSD implementation in the Linux kernel prior to versions 5.19.17 and 6.0.2 is vulnerable to buffer overflow. A client can force the send buffer to shrink by sending an RPC message with garbage data, leading to writes beyond the allocated buffer space.