Executive brief
The Linux kernel's NFS daemon (nfsd) manages file caches to serve network file requests. A use-after-free vulnerability in the file cache disposal mechanism could allow an attacker to crash the system or potentially execute arbitrary code when the kernel references memory that has been freed. This affects systems running affected versions of the Linux kernel that provide NFS services.
Technical details
The vulnerability is a use-after-free (UAF) in the nfsd file cache disposal code. The root cause: the nfsd_fcache_disposal structure, which contains a spinlock and freeme list used to queue file closures, was separately allocated and freed during per-net namespace teardown via nfsd_free_fcache_disposal_net(). However, global kernel subsystems (shrinker, laundrette worker, fsnotify callbacks) could still be executing nfsd_file_dispose_list_delayed() and dereferencing this freed pointer after teardown completed. The fix inlines the spinlock and list directly into struct nfsd_net, giving them the same lifetime as the namespace itself and eliminating the dangling pointer. The attack vector is local (kernel memory corruption), triggered during namespace cleanup while concurrent file disposal is in progress. No user interaction or authentication is required—this is triggered by ordinary nfsd operation and namespace destruction.
Affected products
- Linux Linux kernel multiple versions prior to fix (commit bbf13732f74351d21c5e0e8dd9bd8e1c48dc35d4)
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-09-11: patched: Stable kernel patch signed by Greg Kroah-Hartman