Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during delegation revoke A delegation stateid holds only a bare pointer to its owning nfs4_client and does not keep it alive. The client survives its stateids only because __destroy_client() drains cl_delegations and cl_revoked before free_client() runs. nfs4_laundromat() breaks that invariant: it unhashes an expired delegation from cl_delegations, drops deleg_lock, then revoke_delegation() relinks it onto cl_revoked under cl_lock. In that window the delegation is on neither list, so client_has_state() can report no remaining state. Every teardown path first requires cl_rpc_users to be zero, but the laundromat holds no such reference. A client whose recalled delegation has just timed out can therefore reach free_client() while revoke_delegation() is still about to dereference cl_lock, a use-after-free. Pin the client with cl_rpc_users across the revoke so teardown blocks until it completes, then reap the delegation from cl_revoked. A client already expiring reaps its own, so skip it and leave the delegation on del_recall_lru.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:52.180Z",
  "pubdate": "2026-09-11T20:19:52.180Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel NFSD (NFS server) component during the delegation revocation process. The vulnerability stems from an improper reference counting mechanism for nfs4_client structures, which allows a client to be freed while active delegation revocation tasks are still referencing it.\nThis flaw can lead to kernel memory corruption, potential privilege escalation, or a system crash (Denial of Service). It specifically impacts NFSv4 delegation handling where the nfs4_laundromat() function interacts with delegation revocation. An attacker capable of triggering specific NFSv4 delegation recall and expiration sequences could potentially influence kernel memory states. The vulnerability is triggered during a race condition window where a client is being torn down while its delegation is being moved to the cl_revoked list, causing the revocation process to dereference an already freed client pointer.",
  "technicalDetails": "The root cause of this vulnerability is a reference counting deficit within the NFSD delegation revocation workflow. In the Linux kernel NFSv4 implementation, a delegation stateid maintains a raw pointer to its owning nfs4_client structure without incrementing the client's reference count. Under normal operation, the system relies on __destroy_client() to drain cl_delegations and cl_revoked lists before triggering free_client().\nThe vulnerability manifests within nfs4_laundromat(), which manages the expiration of delegations. When an expired delegation is processed, it is unhashed from cl_delegations and the deleg_lock is dropped. Subsequently, revoke_delegation() is invoked to relink the delegation onto the cl_revoked list under cl_lock. A critical race window exists between unhashing and relinking where the delegation is essentially orphaned from these lists. During this interval, client_has_state() may incorrectly report that no state remains for the client.\nBecause the laundromat process does not hold a reference on cl_rpc_users, the kernel's teardown mechanisms for the client can proceed prematurely. If a client's recalled delegation times out, it is possible for free_client() to execute and deallocate the nfs4_client memory while revoke_delegation() is still active. When revoke_delegation() proceeds to access the cl_lock or perform operations requiring the client structure, it performs a dereference on a dangling pointer, resulting in a use-after-free condition.\nThe attack flow involves: 1) Establishing a client session with the NFS server. 2) Forcing a delegation recall, usually by performing operations that conflict with existing delegations. 3) Triggering the laundromat process via timing manipulation to expire the delegation. 4) Attempting to trigger client teardown (e.g., via session termination or lease expiration) exactly when the revocation logic is attempting to link the orphaned delegation to cl_revoked. The lack of proper pinning of the client object via cl_rpc_users allows the teardown path to succeed, freeing the memory that the revocation path expects to exist, leading to undefined kernel behavior or potential arbitrary code execution."
}