CVE Vulnerability Catalog

In the Linux kernel, the workqueue core clears WORK_STRUCT_PENDING before the callback is invoked, so delayed_work_pending() in lm_breaker_timedout() can return false while the fence worker is already running. This lets the breaker take a duplicate sc_count reference and schedule a new worker that coalesces with the in-progress one. The extra reference is never put, leaking the layout stateid.

In the Linux kernel, nfsd4_copy() leaks an nfsd_file reference when inter-server COPY setup fails. The function returns an error directly, bypassing the out: label that would release the file reference. Each failed operation leaks one nfsd_file, pinning the file, inode, dentry, and vfsmount.

In the Linux kernel, nfsd4_setattr() has a NULL pointer dereference when a SETATTR request includes delegation time attributes (FATTR4_WORD2_TIME_DELEG_ACCESS or FATTR4_WORD2_TIME_DELEG_MODIFY) and the client supplies the special stateid (all 0xFF bytes). The local variable st remains NULL and is then dereferenced, causing a kernel oops. This is remotely triggerable by any NFSv4 client without authentication.

In the Linux kernel, nfsd_direct_write() has a partial-write detection bug. After vfs_iocb_iter_write(), iter.count holds the residual byte count, not the original length, so the break condition is incorrect. Short writes completing between 50% and 99% of the segment are not detected, causing the next segment to be written at the wrong offset and over-reporting the byte count to the NFS client.

In the Linux kernel, nfsd4_create_file() may call fh_compose() with the wrong dentry. dentry_create() can hypothetically return a different dentry than the one passed in, potentially leading to a use-after-free. The fix moves the fh_compose() call until the final dentry is certain.

In the Linux kernel, nfsd4_copy() for async COPY has an initialization order bug. nfs4_init_copy_state() is called before dup_copy_fields(), so the s2s_cp_stateids IDR entry points to the COMPOUND buffer memory that is reused by the next request. This can lead to use-after-free or memory corruption, causing kernel crashes or potential code execution.

A use-after-free (UAF) vulnerability was fixed in the Linux kernel's NFS asynchronous copy mechanism (nfsd). A race between the copy kthread and teardown callers (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) could free or use an already-freed copy structure, double-put nfsd_file, and dereference a freed task_struct.

In the Linux kernel, nfsd4_ff_encode_layoutget() has multiple XDR buffer size calculation errors. These errors can result in an out-of-bounds write or leaking uninitialized kernel memory to the client. The worst case occurs with short strings, where the function writes up to 5 bytes past the reserved XDR buffer.

In the Linux kernel, nfsd4_ff_encode_getdeviceinfo() has an XDR padding calculation error. The da_addr_body reservation does not match the actual bytes written by xdr_encode_opaque(), causing stale reply-page content to leak to the client and misaligning the subsequent version list decode. This occurs on every flexfile GETDEVICEINFO reply.

In the Linux kernel, nfsacld_proc_setacl() for NFSACL v2 SETACL has a bug that can lead to unintended ACL removal. When a SETACL request contains only NFS_ACL, the other pointer (acl_default) remains NULL, and set_posix_acl() with NULL removes the directory's default ACL. Similarly, mask=0 removes both ACLs.

In the Linux kernel, nfsd3_proc_setacl() for NFSv3 SETACL has a bug that can lead to unintended ACL removal. When a SETACL request contains only NFS_ACL, the acl_default pointer remains NULL, and set_posix_acl() with NULL removes the directory's default ACL. Similarly, mask=0 removes both ACLs.

A vulnerability was fixed in the Linux kernel's nfsd module where nfsd_open_local_fh() dereferenced an nfsd_file pointer without holding an RCU read lock. The object could be freed and reallocated by another thread, leading to a use-after-free condition. The fix wraps the cmpxchg and reference acquisition in an rcu_read_lock() section.

In the Linux kernel, nfsd4_copy_notify() published the cpntf state into the IDR and the parent's list before finishing initialization and before recording the owning clientid. A racing OFFLOAD_CANCEL could free the entry, turning the caller's stateid read and cp_p_stateid/cp_p_clid writes into a use-after-free.

In the Linux kernel, init_nfsd() calls nfsd_debugfs_init() before nfsd4_init_slabs(). If slab allocation fails, the early return bypasses nfsd_debugfs_exit(), leaving orphan debugfs files with stale fops pointers into freed module text.

In the Linux kernel, a race condition exists in the nfsd module between the shrinker, GC worker, and fsnotify/lease callbacks versus per-net shutdown in the filecache. An nfsd_file can be unhashed and moved to the dispose list before nfsd_file_cache_shutdown_net() processes it, causing a leak of the file and its associated state. The fix widens the nfsd_gc_lock scope across all three callers of nfsd_file_dispose_list_delayed() and adds a spinlock barrier in the per-net shutdown function.

In the Linux kernel's nfsd module, a client could send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD request with an out-of-range nseconds field for atime/mtime (tv_nsec >= NSEC_PER_SEC). The value passed protocol-level validation but was not normalized, leading to on-disk metadata corruption on ext4 and XFS filesystems (incorrect seconds and year). The fix rejects such requests with NFS3ERR_INVAL before any changes are made.

In the Linux kernel, the NFSv2 attribute decoder (svcxdr_decode_sattr) converts wire useconds to nanoseconds by multiplying by 1000 and storing the result in tv_nsec. On 32-bit (ILP32) architectures, an out-of-range useconds value such as 4294968 overflows and produces an incorrect tv_nsec value (e.g., 704) that passes later range checks. The vulnerability affects NFSv2 SETATTR and CREATE operations and was fixed by rejecting useconds values greater than 1000000 during decoding.

A memory (reference) leak of posix_acl objects exists in the nfsd module of the Linux kernel. When an NFS client sends a malformed OPEN operation carrying POSIX ACL attributes, nfsd4_open() is never invoked, so the allocated posix_acl structures are not released. The issue also affects the v4.0 replay path.

A use-after-free vulnerability was found in the Linux kernel nfsd subsystem related to copy-notify stateids. The _free_cpntf_state_locked() function only unlinked an entry once its refcount reached zero, so revoke paths (parent-stid drain, OFFLOAD_CANCEL, and laundromat expiry) could drop a reference without unlinking, leaving the entry discoverable to a concurrent reader. The fix adds revoke_cpntf_state_locked(), which unhashes the entry from the IDR and sc_cp_list first and defers the final free to any holder.

In the Linux kernel, __destroy_client() releases open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. During client teardown the laundromat can free the owner as __destroy_client() dereferences it, causing a NULL dereference in remove_blocked_locks().