Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a local user to cause unexpected behavior or service disruptions. The issue stems from how the server tracks file locks, occasionally leading it to incorrectly report that locks are still held when they have actually been released. This can cause subsequent file access requests to fail, potentially impacting the availability of shared files and the reliability of applications relying on NFS storage.
Technical details
A logic error in nfsd4_release_lockowner() in the Linux kernel's NFS server (nfsd) uses an unreliable reference count (so_count) to determine if locks are still held. This count can include transient references from concurrent LOCK requests, leading to false-positive NFS4ERR_LOCKS_HELD errors. When a client receives this error but assumes the release succeeded, it may later reuse the lock owner ID with a sequence ID of zero, which the server rejects with NFS4ERR_BAD_SEQID because it never actually released the original owner. The fix replaces the unreliable so_count check with a non-sleeping check_for_locks() call using find_any_file_locked().
Affected products
- Linux Linux kernel 5.19 to 6.1.79, 6.2 to 6.6.15, 6.7 to 6.7.3
Timeline
- 2024-03-13: advisory: Initial publication of CVE-2024-26629
- 2024-01-25: patched: Fix backported to various stable kernel branches
References
- https://git.kernel.org/stable/c/10d75984495f7fe62152c3b0dbfa3f0a6b739c9b
- https://git.kernel.org/stable/c/8f5b860de87039b007e84a28a5eefc888154e098
- https://git.kernel.org/stable/c/99fb654d01dc3f08b5905c663ad6c89a9d83302f
- https://git.kernel.org/stable/c/b7d2eee1f53899b53f069bba3a59a419fc3d331b
- https://git.kernel.org/stable/c/c6f8b3fcc62725e4129f2c0fd550d022d4a7685a
- https://git.kernel.org/stable/c/e4cf8941664cae2f89f0189c29fe2ce8c6be0d03
- https://git.kernel.org/stable/c/edcf9725150e42beeca42d085149f4c88fa97afd