Executive brief
A flaw was discovered in the Linux kernel's implementation of Parallel NFS (pNFS), a protocol used for high-performance file sharing. Under specific conditions when retrying a file layout request, the system may attempt to access memory that has already been freed. This could lead to a system crash or unpredictable behavior, potentially impacting the stability of servers using networked storage.
Technical details
A use-after-free (UAF) vulnerability was identified in fs/nfs/pnfs.c within the Linux kernel. The flaw exists in the pnfs_update_layout() function specifically during the NFS_LAYOUT_RETURN handling branch. When pnfs_prepare_to_retry_layoutget() succeeds, the code invokes pnfs_put_layout_hdr(lo), which can release the layout header. However, a subsequent call to the tracepoint trace_pnfs_update_layout() still references the 'lo' pointer, leading to a UAF when the tracepoint accesses the structure's fields. The fix involves reordering the operations so the tracepoint is called before the reference is released. This issue affects various stable branches including 5.10.y, 5.15.y, and later versions.
Affected products
- Linux Linux kernel 5.10.9 to 5.10.260, 5.11 and later
Timeline
- 2026-05-18: other: Vulnerability fix authored
- 2026-07-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/13e198a90ca4050f4bee8a3f23680389a6563ccc
- https://git.kernel.org/stable/c/1f24b8302c77dcaf79c64c073877a3b9f4dd25d2
- https://git.kernel.org/stable/c/200e7637f4d6a1342987045eea72641524f909dc
- https://git.kernel.org/stable/c/2883ddd7542b4437a2ab4908fe2773f690e20889
- https://git.kernel.org/stable/c/4ad8b9a85dbf57ca532ee9e65ad7e6498bfbbf98
- https://git.kernel.org/stable/c/7e37e9b3e82ade881e1798e2f4fcc54aff7793c1
- https://git.kernel.org/stable/c/9645aaf689aff57427ece3b9fa47d5b5399417f4