Executive brief
The Linux kernel's NFS server (nfsd) contains a memory corruption vulnerability in session slot management. When the kernel attempts to shrink NFS session resources, it can free memory slots that are still actively in use by client requests. An attacker on the network can trigger this by sending crafted NFS SEQUENCE commands, causing the server to corrupt kernel memory, leading to crashes, data corruption, or potential code execution.
Technical details
The vulnerability is a use-after-free and heap corruption in the NFSv4 session slot management code (nfsd4_sequence). When the session shrinker reduces se_target_maxslots below the current maximum, the code fails to validate whether the client's slotid is within the safe range or whether the slot is marked NFSD4_SLOT_INUSE before freeing it. An attacker can send a SEQUENCE request using a high-numbered slot while satisfying the three shrink conditions, causing the kernel to free the active slot. The freed memory is then written to via nfsd4_store_cache_entry(), corrupting heap structures. Additionally, concurrent SEQUENCE operations on other high-numbered slots can be freed while in use. The fix requires checking that the current request's slotid is below the shrink boundary and deferring the free if any slots in the to-be-freed range are marked in-use.
Affected products
- Linux Linux kernel nfsd component
Timeline
- 2026-09-11: disclosed
- 2026-09-11: advisory