Executive brief
The Linux kernel's NFS server (NFSD) has a use-after-free memory vulnerability in the code that handles export removal. When an administrator removes an NFS export using the exportfs command, a race condition can occur where the kernel attempts to access a client data structure after it has already been freed from memory, potentially causing a system crash or allowing code execution.
Technical details
The vulnerability is a use-after-free bug in the nfsd4_revoke_export_states() function in fs/nfsd/nfs4state.c. The function temporarily releases the client_lock while processing revocation of state IDs, but the stateid reference does not prevent the underlying client structure from being freed by concurrent teardown. When an administrator runs exportfs -u to unlock/remove an export (via NFSD_CMD_UNLOCK_EXPORT), the kernel reads clp->cl_minorversion after releasing the lock, allowing a race condition where the client has been freed. The fix pins the client with cl_rpc_users under client_lock before dropping the lock and properly unpins it afterward, matching the pattern already used in nfsd4_revoke_states(). This is a local attack vector requiring administrator privileges to trigger the export removal operation.
Affected products
- Linux Linux kernel linux-2.6.11 through linux-7.2 and later (all versions with NFSD support)
Timeline
- 2026-09-16: disclosed
- 2026-07-09: patched: Fix committed upstream as commit 2108de53568a64936a0da3e04d85c35df98d3fb6
- 2026-09-11: patched: Backported to stable kernels via commit c05ae58fe06ce2ac34312f649e71c3596bdde358