Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component can cause the system to hang for up to 15 minutes during certain shutdown operations. This occurs when the server attempts to communicate with a client that is in an inactive 'courtesy' state, leading to a temporary denial of service. While it does not expose data, it can disrupt operations and system availability.
Technical details
A denial of service vulnerability exists in the Linux kernel NFSD (NFS server) implementation. The root cause is a logic error in nfsd4_shutdown_callback where the function hangs because it waits for cl_cb_inflight to reach zero, but callbacks are not processed for clients in the 'courtesy' state. This results in a hang that typically lasts 15 minutes until the TCP connection times out. The fix modifies nfsd4_run_cb_work to skip RPC calls if the client is in the NFSD4_COURTESY state. This issue affects multiple stable kernel branches including 5.10, 5.15, 6.1, 6.6, 6.12, and 6.13.
Affected products
- Linux Linux Kernel 5.10.220 to 5.10.235, 5.15.154 to 5.15.179, 5.19 to 6.1.129, 6.2 to 6.6.79, 6.7 to 6.12.16, 6.13 to 6.13.4
Timeline
- 2025-01-30: other: Patch authored by Dai Ngo
- 2025-02-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/036ac2778f7b28885814c6fbc07e156ad1624d03
- https://git.kernel.org/stable/c/23ad7797c74cd8f7f90617f1e59a8703e2b43908
- https://git.kernel.org/stable/c/38d345f612503b850c2973e5a879f88e441b34d7
- https://git.kernel.org/stable/c/abed68027ea3ab893ac85cc46a00e2e64a324239
- https://git.kernel.org/stable/c/cedfbb92cf97a6bff3d25633001d9c44442ee854
- https://git.kernel.org/stable/c/e88d2451cd42e025465d6b51fd716a47b0b3800d
- https://git.kernel.org/stable/c/efa8a261c575f816c7e79a87aeb3ef8a0bd6b221