Executive brief
The Linux kernel's NFS server (NFSD) component has a flaw where certain administrator operations can crash the server during startup. A system administrator with CAP_SYS_ADMIN capability can trigger a kernel crash by writing to configuration files or sending netlink commands before the NFS service is fully initialized, even without actually starting the service. This results in a complete denial of service for the NFS server.
Technical details
The vulnerability is a NULL pointer dereference in the NFSD (NFS daemon) kernel module. The root cause is that three unlock/revocation code paths (write_unlock_fs, nfsd4_revoke_states, nfsd4_cancel_copy_by_sb) check only if nn->nfsd_serv is set to gate access to NFSv4 client hash tables, but this flag is set before memory tables are allocated. An attacker with CAP_SYS_ADMIN can trigger these code paths via /proc/fs/nfsd/unlock_filesystem writes or netlink commands (NFSD_CMD_UNLOCK_FILESYSTEM, NFSD_CMD_UNLOCK_EXPORT) during the startup window between listener initialization and table allocation, causing dereferencing of an unallocated NULL pointer. The fix changes the gating condition from nn->nfsd_serv to NFSD_NET_UP, which is set only after tables are allocated and cleared before they are freed. No user interaction is required beyond local privileged access.
Affected products
- Linux Linux kernel Multiple versions (fix backported across stable branches linux-5.10.y through linux-6.19.y and later)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-09-11: patched: Fix merged into stable trees by Greg Kroah-Hartman