Executive brief
A vulnerability has been identified in the Linux kernel's Network File System (NFS) server component. When system tracing is enabled, a specific type of network request can cause the server to crash. This could lead to a denial-of-service, interrupting file sharing operations and impacting business continuity for systems relying on NFS.
Technical details
A vulnerability in the Linux kernel's NFSD (NFS server) implementation can lead to a kernel crash in nfsd4_read_release(). The issue is triggered when the trace_nfsd_read_done trace point is active and a specific pynfs read test (read.testNoFh) is executed. The root cause is an ordering issue where trace_nfsd_read_done was called after nfsd_file_put, potentially accessing data that was no longer valid or initialized. The fix reorders these calls to ensure the trace point executes while the file reference is still held. This affects various stable kernel branches including 5.10, 5.15, 6.1, and 6.6.
Affected products
- Linux Linux Kernel 5.10.220 to 5.10.247, 5.15.154 to 5.15.197, 6.1.24 to 6.1.159, 6.3 to 6.11.x
Timeline
- 2025-12-08: advisory
- 2025-11-24: patched
References
- https://git.kernel.org/stable/c/03524ccff698d4a77d096ed529073d91f5edee5d
- https://git.kernel.org/stable/c/2ac46606b2cc49e78d8e3d8f2685e79e9ba73020
- https://git.kernel.org/stable/c/375fdd8993cecc48afa359728a6e70b280dde1c8
- https://git.kernel.org/stable/c/8f244b773c63fa480c9a3bd1ae04f5272f285e89
- https://git.kernel.org/stable/c/930cb4fe3ab4061be31f20ee30bb72a66f7bb6d1
- https://git.kernel.org/stable/c/a4948875ed0599c037dc438c11891c9012721b1d
- https://git.kernel.org/stable/c/abb1f08a2121dd270193746e43b2a9373db9ad84