Executive brief
The Linux kernel's NFS server (NFSD) component has a resource leak that prevents filesystem exports from being unmounted. When NFS client connections are closed, certain state tracking structures fail to properly release their references to exports, causing the mount point to remain unavailable for prolonged periods. This affects server stability and administrative operations on systems providing NFS service.
Technical details
A resource reference counting bug exists in free_ol_stateid_reaplist() where open and lock stateids bypass the normal cleanup path nfs4_put_stid(). Both stateid types acquire an sc_export reference during initialization (nfs4_open() for open stateids, init_lock_stateid() for lock stateids) but the reaping function calls ->sc_free() directly without releasing this reference. Additionally, nfs4_put_stid() reads sc_export before acquiring cl_lock, creating a race window where concurrent revocation via drop_stid_export() could release the same reference twice. The fix ensures sc_export is released in the reaping path and read under cl_lock to serialize concurrent operations.
Affected products
- Linux Linux kernel multiple versions affected (prior to fix)
Timeline
- 2026-09-17: disclosed