Executive brief
The Linux kernel's NFS server (NFSD) component has a memory safety bug in how it cleans up client connections when they terminate. When a client disconnects, the kernel frees lock owner data structures while still trying to access them, causing the system to crash with a NULL pointer dereference. This vulnerability affects any system running an NFS server and could allow a remote attacker to trigger a denial-of-service attack by simply disconnecting in a particular way.
Technical details
This is a use-after-free vulnerability in the NFSD subsystem's client teardown path (specifically in __destroy_client()). The root cause is a race condition where the client lock (cl_lock) is not held across the entire lifecycle of lock owner cleanup: the laundromat thread independently frees blocked locks via nn->blocked_locks_lru, dropping the owner reference (flc_owner), while __destroy_client() simultaneously dereferences the freed owner in remove_blocked_locks(). The fix adds proper reference counting and lock ordering—holding cl_lock across owner unhashing, taking an explicit reference before releasing the lock, and releasing the lock before calling remove_blocked_locks() and nfs4_put_stateowner(), which require blocked_locks_lock and cl_lock respectively. The vulnerability is remotely triggerable via NFS client disconnect sequences and results in kernel panic; no authentication is required beyond initiating an NFS connection.
Affected products
- Linux Linux kernel affected versions include at least 4.14 through 6.9 and later (based on stable tree branches shown)
Timeline
- 2026-09-11: disclosed: Published to NVD
- 2026-07-09: patched: Fix committed upstream as commit 5e2fa29d223a9a1e6a948e40b109d09081d1decd
- 2026-09-14: patched: Patches integrated into stable kernel releases