Executive brief
The Linux kernel's NFS server (nfsd) has a race condition in its request processing logic. The code uses a counter (rq_status_counter) to synchronize between a request handler and a monitoring reader, but certain error paths fail to properly reset the counter to its expected state. This allows the monitoring reader to access request fields while they are still being modified, potentially causing buffer overruns or data corruption.
Technical details
The vulnerability is a synchronization bug in the nfsd_dispatch() function. The function sets rq_status_counter to an odd value when decoding starts and should reset it to even when processing completes, forming a seq-lock-like protocol with a lockless reader (nfsd_nl_rpc_status_get_dumpit()). However, three error paths (cache hits, dropped requests, and encoding failures) return without resetting the counter to even. When the counter remains odd across requests, the lockless reader treats actively mutating fields (such as args->ops and args->opcnt during NFS compound decode) as stable, enabling it to read past the end of an 8-element inline array. The fix adds a helper function nfsd_status_counter_set_idle() that must be called on all return paths following the odd-valued store to properly advance the counter to the next even value.
Affected products
- Linux Linux kernel multiple stable and mainline versions prior to fix commit f6045886fe3f14f269f683d64021b004a50d0efa
Timeline
- 2026-09-11: disclosed
- 2026-08-10: patched: upstream commit f6045886fe3f14f269f683d64021b004a50d0efa