Executive brief
The Linux kernel's NFSv4 server (NFSD) component can crash when processing specially crafted file server requests that exploit inter-server copy operations. A remote attacker can trigger a NULL pointer dereference in the NFSD worker thread, causing a denial of service on systems exporting NFS shares.
Technical details
This is a NULL pointer dereference vulnerability in the Linux kernel's NFSD (NFS Server Daemon) component, specifically in the NFSv4.2 inter-SSC (server-side copy) code path. When CONFIG_NFSD_V4_2_INTER_SSC is enabled, the nfsd4_putfh() function can return success with both fh_dentry and fh_export set to NULL when handling a stale foreign filehandle with no_verify=true. The compound dispatch loop fails to prevent subsequent operations from executing with a NULL fh_dentry; for example, a SETATTR operation dereferences fh_export->ex_path.mnt without validation, causing a crash. A remote client can exploit this by crafting a NFSv4 COMPOUND request that includes an inter-SSC COPY with an additional operation (like SETATTR) inserted between the source PUTFH and SAVEFH. The fix gates the dispatch loop to only allow OP_SAVEFH or operations marked ALLOWED_WITHOUT_FH to proceed when NFSD4_FH_FOREIGN is set with a NULL fh_dentry. Patch is available in Linux kernel commit c59738a00aa51b16adc1b5ceb7c80877168efb4d.
Affected products
- Linux Linux kernel All versions with CONFIG_NFSD_V4_2_INTER_SSC enabled; patch in commit c59738a00aa51b16adc1b5ceb7c80877168efb4d
Timeline
- 2026-09-11: disclosed
- 2026-09-14: patched: Patch committed to stable trees