Executive brief
The Linux kernel's lockd (network lock daemon) and nfsd (NFS file server) modules interact through an unprotected shared pointer. When the nfsd module is unloaded, lockd can still access stale memory references pointing into nfsd's code and data, leading to crashes or potential code execution. This affects NFS servers that dynamically load/unload the nfsd module.
Technical details
This is a use-after-free vulnerability in the lockd/nfsd binding mechanism. The nlmsvc_ops pointer is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() using plain stores without synchronization, while lockd dereferences it unguarded from fs/lockd/svcsubs.c. After rmmod nfsd, lockd may load a stale pointer referencing nfsd's .rodata or .text sections, resulting in NULL dereference or module-text use-after-free. The fix declares nlmsvc_ops as __rcu, uses rcu_assign_pointer() for publication and RCU_INIT_POINTER() + synchronize_rcu() for clearing, and adds module pinning via try_module_get/module_put across indirect calls.
Affected products
- Linux Linux Kernel 2.6.12 and later (vulnerable since initial commit 1da177e4c3f4)
Timeline
- 2026-09-11: disclosed
- 2026-08-10: patched: Fix committed upstream (641e5e20852359b8c31149be4598884e30652f60)