Executive brief
The Linux kernel's NFS server (NFSD) component has a race condition that can cause a server to crash or potentially execute arbitrary code when processing client connections. During normal cleanup of closed NFS file handles, a client structure can be freed while another part of the code is still trying to access it, leading to a use-after-free memory error. This affects NFS server availability and could impact any organization relying on NFS for shared storage.
Technical details
This is a use-after-free vulnerability in the Linux kernel's NFSD (NFS server) implementation, specifically in the close_lru (closed list reaping) cleanup logic. The vulnerable component is fs/nfsd/nfs4state.c. The laundromat thread reaps timed-out nfs4_openowner entries and calls nfs4_put_stid() after dropping the client_lock, which dereferences the nfs4_client structure. A concurrent force_expire_client() call can free the client during this window, causing nfs4_put_stid() to read freed memory. The fix pins the client reference using cl_rpc_users before dropping client_lock and skips already-expiring clients. The attack requires no special privileges or network access beyond normal NFS client connectivity, as the race can be triggered through normal client close operations. Patches are available in the Linux stable kernel tree.
Affected products
- Linux Linux kernel Affecting multiple versions; fix backported to stable branches
Timeline
- 2026-09-16: disclosed
- 2026-09-21: patched: Stable kernel fix released
- 2026-07-09: other: Upstream fix commit 2330b788d732f43668b965b3105b37ceb276dfea