Executive brief
The Linux kernel's SUNRPC service layer fails to check for memory allocation errors when initializing per-CPU statistics counters. When these allocations fail under memory pressure, the kernel continues to operate with uninitialized data structures, corrupting kernel memory and potentially causing system instability. This affects NFS, NLM (lockd), and NFS callback services running on Linux systems.
Technical details
The vulnerability is a resource allocation checking failure in the __svc_create() function within the SUNRPC subsystem. When percpu_counter_init() fails to allocate memory for three per-pool statistics counters on SMP systems, the function ignores the error and returns a partially initialized svc_serv structure. Subsequent hot-path code in svc_xprt_enqueue(), svc_handle_xprt(), and svc_pool_wake_idle_thread() then increments these NULL-backed counters, causing out-of-bounds writes to the per-CPU area and corrupting kernel memory. The vulnerability is triggered by memory allocation failures during RPC server startup, requiring local administrative access or fault injection; remote exploitation is not possible. The fix checks each percpu_counter_init() return value and properly unwinds allocations on failure, preventing the broken service from becoming live.
Affected products
- Linux Linux kernel <unspecified; percpu_counter_init error checking missing prior to fix