Executive brief
A vulnerability in the Linux kernel's Network File System (NFS) server component could lead to system instability or crashes. When processing certain malformed network requests, the system may attempt to release memory using uninitialized or 'stale' data from previous operations. This issue primarily affects the reliability and availability of servers providing NFS file-sharing services.
Technical details
A vulnerability exists in nfsd4_decode_secinfo_no_name() within the Linux kernel's NFSD implementation. Due to a change in how struct nfsd4_compoundargs is cleared (commit 3fdc54646234), the iops array may contain stale data between RPC calls. If an XDR stream is truncated, the decoder returns nfserr_bad_xdr before sin_exp is initialized to NULL. The subsequent error cleanup path calls nfsd4_secinfo_no_name_release(), which executes exp_put() on the stale pointer, leading to a potential kernel oops or memory corruption. The fix involves moving the sin_exp initialization before the first failable decode step.
Affected products
- Linux Linux kernel 5.10.220 to 5.10.260, 5.15.154 to 5.15.211, and others starting from 3fdc54646234
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/161d1aaeb04d620d3692639700512bb5038c1e10
- https://git.kernel.org/stable/c/1e04be34cafae119e82bcaccd6d28a20f72a3647
- https://git.kernel.org/stable/c/46eb17d45be69d28c7a23ea03283b207426a8232
- https://git.kernel.org/stable/c/49de5d31dd8fdebf78bdeaf196b0ca5cd5c75439
- https://git.kernel.org/stable/c/5ec37edcb534f3fc92304be236d37f08e6545585
- https://git.kernel.org/stable/c/8836405abdc53ca3dd5fc68b2cf6f8f012fad011
- https://git.kernel.org/stable/c/9e18e83b8846a5c3fe13fc8a464b4865d33996c6