Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already linked it into the s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the membership reference) and none held for the caller. A racing OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable so_id) could reach manage_cpntf_state() and free the entry, turning the caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid writes into use-after-free. The owning clientid was also only recorded after publication, so it could not gate an ownership check in that window. Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state() before nfs4_init_cp_state() publishes the entry, and return it with an extra reference. The caller reads the stateid under that reference and drops it with nfs4_put_cpntf_state(); on a late error the laundromat reaps the entry.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:53.397Z",
  "pubdate": "2026-09-11T20:19:53.397Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists in the Linux kernel's nfsd subsystem, specifically within the nfsd4_copy_notify function. The vulnerability arises from an race condition occurring during the initialization of copy-notify state structures.\nThe flaw allows an attacker to trigger the premature deallocation of a state object while the system is still performing write operations on it. This occurs because the object is published to global tracking structures before its internal state is fully initialized.\nSuccessful exploitation allows a local or network-based attacker to cause a kernel-level use-after-free, which can lead to system crashes (Denial of Service) or potentially arbitrary code execution if memory can be reallocated and controlled in a specific manner.\nThe vulnerability affects systems running nfsd with support for server-to-server copy operations. Exploitation requires an attacker to send crafted OFFLOAD_CANCEL requests that race against the copy-notify initialization process. The reliance on predictable identifiers, such as the so_id, may facilitate the targeting of these vulnerable structures.",
  "technicalDetails": "The root cause of this vulnerability is a race condition in the nfsd4_copy_notify function, where the cpntf state object is linked into the s2s_cp_stateids IDR and the parent's sc_cp_list prematurely. Specifically, the object is published before its internal fields, including cpn_cnr_stateid, cp_p_stateid, and cp_p_clid, are fully initialized.\nDuring this window of exposure, the structure exists in a globally reachable state with a reference count of one, representing only the membership reference. Because the owning client identifier is not yet recorded, the system lacks the necessary context to gate ownership checks for racing requests.\nThe attack flow proceeds as follows: 1) A legitimate nfsd4_copy_notify operation begins, allocating a new state structure. 2) Before this operation populates the object's sensitive fields, it publishes the object into the IDR and parent list. 3) An attacker sends a specially crafted OFFLOAD_CANCEL request using a guessed so_id that corresponds to the newly allocated but incomplete entry. 4) The manage_cpntf_state function, invoked by the cancellation request, identifies the object and decrements its reference count, triggering a free operation. 5) The original nfsd4_copy_notify thread proceeds to access the freed memory to write the stateid and client information, resulting in a classic Use-After-Free condition.\nThe vulnerability occurs within the nfsd component of the Linux kernel. The exploitation process relies on the predictability of the so_id and the ability to interact with the nfsd RPC interface. By causing the use-after-free, an attacker can corrupt kernel memory state, which could potentially be leveraged to bypass security mechanisms or escalate privileges if combined with other kernel exploits.\nThe fix involves refactoring the initialization sequence so that all required fields, such as cp_p_stateid and cp_p_clid, are populated inside nfs4_alloc_init_cpntf_state before the entry is published by nfs4_init_cp_state. Furthermore, the entry must be returned with an additional reference held, ensuring the caller retains ownership until the write operations are safely completed and the reference is explicitly dropped."
}