Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during admin state revocation A stateid holds only a bare pointer to its nfs4_client; a stateid reference does not pin it. The client survives only because __destroy_client() drains its stateids before free_client() runs. nfsd4_revoke_states() drops nn->client_lock across revoke_one_stid(), which dereferences the client to revoke a stateid and read clp->cl_minorversion. A teardown racing the dropped lock can free the client first. Pinning cl_rpc_users under client_lock blocks the DESTROY_CLIENTID and EXCHANGE_ID teardown, which refuses while cl_rpc_users is non-zero. force_expire_client() ignores it: once its wait for cl_rpc_users to reach zero has passed, a later pin goes unnoticed. Under client_lock, skip a client whose cl_time is already zero -- force_expire_client() clears it there before waiting -- otherwise pin cl_rpc_users before dropping the lock. The walk then either sees the expiry and skips, or pins in time for that wait to cover the revoke.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:52.300Z",
  "pubdate": "2026-09-11T20:19:52.300Z",
  "executiveSummary": "A critical use-after-free (UAF) vulnerability exists in the Linux kernel's Network File System (NFSD) component, specifically triggered during administrative state revocation processes.\nThe vulnerability arises from an improper object lifecycle management pattern where stateid references fail to maintain a pin on the associated nfs4_client structure.\nBy racing an administrative state revocation against a client teardown, an attacker can trigger a race condition that leads to the premature freeing of the client structure while it is still being accessed by the revocation logic.\nThe impact includes potential kernel memory corruption, arbitrary code execution, or system instability, leading to a denial-of-service (DoS) condition.\nExploitation requires an authenticated user with the ability to interact with the NFS server and trigger state revocation operations, typically involving administrative privileges or specific administrative sequences provided by the environment.\nThis vulnerability is rooted in a concurrency flaw within the nfsd4_revoke_states() function, highlighting the necessity for robust reference counting during asynchronous teardown sequences in the kernel.",
  "technicalDetails": "The vulnerability is located within the NFSD state management subsystem, specifically in the interaction between the nfsd4_revoke_states() function and the client teardown path initiated by __destroy_client().\nRoot Cause Analysis: The stateid data structure holds a bare pointer to an nfs4_client but does not increment the reference count or provide a pinning mechanism. In normal operation, the client survives solely because __destroy_client() performs a synchronous drainage of all stateids before proceeding to free_client().\nThe flaw manifests when nfsd4_revoke_states() releases the nn->client_lock mutex to perform individual state revocation via revoke_one_stid(). During this unlocked window, the kernel dereferences the client pointer to perform checks (e.g., verifying cl_minorversion). A concurrent teardown operation, such as DESTROY_CLIENTID or EXCHANGE_ID, can successfully acquire the lock, complete the teardown, and call free_client() on the nfs4_client memory.\nWhen execution returns to the revocation logic, the code continues to operate on the dangling pointer, leading to a use-after-free scenario.\nExploitation Flow: 1) An attacker initiates a state revocation process. 2) The system enters the revoke_one_stid() logic and drops the client_lock. 3) The attacker triggers a separate process to destroy the NFS client session. 4) The teardown process wins the race, reaches free_client(), and deallocates the client memory. 5) The interrupted revocation logic resumes, attempting to access members of the now-freed nfs4_client object.\nThe resolution involves pinning the client using cl_rpc_users while holding the client_lock, which effectively blocks the concurrent teardown path as it relies on the reference count hitting zero to proceed. The patch further integrates a check to skip clients where cl_time has already been cleared (indicating an active expiry process), ensuring that the walk logic correctly respects current client state transitions and prevents double-pinning or premature teardown blocking."
}