Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component could allow a local attacker to crash the system. The issue occurs when the system incorrectly cleans up internal data related to shared folders while they are still being accessed. This can lead to a system failure (NULL pointer dereference), potentially disrupting file-sharing services and overall system availability.
Technical details
A race condition exists in the Linux kernel's NFSD implementation within the svc_export_put() and expkey_put() functions. The vulnerability is caused by sub-objects (ex_path and auth_domain) being freed immediately when a reference count drops to zero, rather than waiting for the RCU grace period to expire. RCU readers in e_show() and c_show() may still be accessing these objects, leading to a NULL pointer dereference in d_path. The fix involves using queue_rcu_work() to defer cleanup to a process context after the RCU grace period, ensuring safe access for concurrent readers.
Affected products
- Linux Linux Kernel 6.14 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-04-03: advisory: Initial disclosure and NVD publication
- 2026-03-25: patched: Fix committed to stable kernel tree