Description

In the Linux kernel, the following vulnerability has been resolved: lockd: pin next file across nlm_inspect_file lock-drop nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new behavior is intentional: such files are stale and should not persist in the table.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:30.173Z",
  "pubdate": "2026-09-11T20:19:30.173Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel's lockd component within the nlm_traverse_files function.\nThe vulnerability arises from improper management of object lifecycles during hash bucket traversal when dropping and re-acquiring mutex locks.\nAn attacker capable of triggering specific NFS lock operations can induce a race condition, leading to the deallocation of a file structure that is still referenced by the iterator.\nSuccessful exploitation results in a kernel-space use-after-free, which can be leveraged to achieve arbitrary code execution, denial-of-service via kernel panic, or potential information disclosure.\nThe flaw affects the NLM (Network Lock Manager) subsystem, specifically impacting file table management. The primary risk involves memory corruption leading to system instability or security bypasses.\nExploitation requires the attacker to influence concurrent NLM operations, necessitating local access or the ability to communicate with the target's RPC-based lockd service.",
  "technicalDetails": "The vulnerability resides in the nlm_traverse_files function in the Linux kernel's lockd implementation. This function iterates through hash buckets of file structures to perform maintenance or inspection tasks.\nThe root cause is a race condition occurring during the lock-drop window. While nlm_traverse_files traditionally pins the current file structure using f_count++, it fails to pin the 'next' pointer in the linked list traversal before releasing the mutex via mutex_unlock.\nDuring this window, a concurrent call to nlm_release_file can trigger the final kfree of the 'next' object if the reference count reaches zero. Because the iterator logic maintains a pointer to this now-freed memory, the subsequent loop iteration attempts to dereference a dangling pointer.\nStep-by-step exploitation flow: 1) The attacker initiates an NLM operation that traverses the file table. 2) The iterator reaches a file structure and prepares to inspect it, dropping the mutex. 3) A concurrent process invokes nlm_release_file on the 'next' file in the list. 4) The 'next' file is kfreed because it lacks an active pin. 5) The iterator resumes after the mutex is re-acquired and attempts to access the memory address of the freed 'next' structure.\nThis leads to a classic use-after-free scenario. The severity is exacerbated by the fact that the allocator might reassign this memory to another kernel structure before the iterator completes its cycle.\nThe patch resolves this by pinning both the current and the next file structures across the lock-drop window. By swapping pinned cursors, the iterator ensures that the 'next' object is explicitly kept alive. Furthermore, the fix moves from using a cached f_locks field to utilizing nlm_file_inuse, which performs a live walk of the inode lock list. This ensures that even files skipped by the is_failover_file predicate are correctly evaluated, preventing the persistence of stale files and ensuring memory consistency across the traversal logic."
}