Executive brief
A flaw in the Linux kernel's NFS server (nfsd) component allows a use-after-free condition in copy-notify state management. When multiple concurrent operations reference copy-notification state IDs, the revocation logic can prematurely free memory that is still being accessed by other threads, leading to system crashes or potential code execution with kernel privileges.
Technical details
The vulnerability is a use-after-free flaw in the nfsd copy-notify state management code. The root cause is in the _free_cpntf_state_locked() function, which only unlinks copy-notify stateids from tracking structures when their reference count reaches zero. When a concurrent reader holds an elevated reference (via find_cpntf_state() or manage_cpntf_state()), revoke paths can decrement the reference without unlinking the entry, leaving it discoverable but orphaned. A subsequent revoke or laundromat cleanup then frees the memory while the reader still holds a pointer to it. The fix introduces revoke_cpntf_state_locked() to unhash entries from the IDR and parent list before freeing, ensuring readers have proper ownership semantics. The attack vector requires local network access to trigger concurrent NFS operations, and the impact is a kernel information disclosure or denial-of-service via crash.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed