Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix UAF in async copy cancel and shutdown An async copy could be freed or used after free while a teardown caller (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the copy kthread: - find_async_copy() bumped copy->refcount but left the copy on clp->async_copies, so the reaper's cleanup_async_copy() could run release_copy_files() concurrently with a cancel/shutdown caller. Both put and NULL nf_src/nf_dst without a common lock, double-putting the nfsd_file and freeing it early. - nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses of the copy (nfsd_update_cmtime_attr() on copy->nf_dst, nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit as "kthread done, skip kthread_stop()", so a teardown caller ran release_copy_files() -- which puts and NULLs nf_dst -- while the kthread still dereferenced it (NULL/UAF). - copy->copy_task was never pinned. The one-shot kthread self-reaps on return, so kthread_stop()'s get_task_struct() could touch a freed task_struct. - co_cb is embedded in the copy, but nfsd4_send_cb_offload() held a reference only on the client, so a concurrent teardown could free the copy while the CB_OFFLOAD callback was in flight. Fix the teardown lifetime as a whole: - find_async_copy() unlinks the copy (clear cp_clp, list_del_init) under async_lock; the cancel, shutdown, and sb-cancel paths drop the list-membership reference via nfs4_put_copy() after nfsd4_stop_copy(). Drop the now-redundant list_del fixup from cleanup_async_copy(). - Because unlinking hides the copy from the reaper, its cleanup_async_copy() can no longer remove the copy's s2s_cp_stateids entry; the cancel/shutdown/sb-cancel paths now call nfs4_free_copy_state() themselves (while cp_clp is still valid) so the entry does not dangle at freed memory for the laundromat and manage_cpntf_state() to dereference. - Give the kthread its own reference, taken in nfsd4_copy() before wake_up_process() and dropped at the end of nfsd4_do_async_copy(); call wake_up_process() before list_add(). - Pin the task_struct with get_task_struct() in nfsd4_copy(), released in nfs4_put_copy(), so kthread_stop() is safe whenever the kthread exits. Set NFSD4_COPY_F_STOPPED only in nfsd4_stop_copy(), which now always kthread_stop()s before release_copy_files(); completion is still reported via NFSD4_COPY_F_COMPLETED, so nfsd4_has_active_async_copies() is unaffected. Each teardown caller removes the copy from clp->async_copies first, so kthread_stop() runs exactly once. - Take a copy reference in nfsd4_send_cb_offload(), dropped in nfsd4_cb_offload_release(). The kthread still holds its own reference there, so the refcount_inc() cannot race the final free. - Read cp_clp with smp_load_acquire() to pair with the unordered set_bit()/clear_bit() writers (Documentation/atomic_bitops.rst).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:54.143Z",
  "pubdate": "2026-09-11T20:19:54.143Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists in the Linux kernel's nfsd (NFS server) component, specifically affecting the asynchronous copy mechanism.\nThe flaw originates from complex race conditions during the teardown of async copy tasks, involving OFFLOAD_CANCEL, nfsd4_shutdown_copy, and nfsd4_cancel_copy_by_sb operations.\nThis vulnerability allows an attacker to trigger memory corruption or arbitrary code execution by exploiting inconsistent object lifetimes between the copy kthread and various cleanup routines.\nThe primary risk is a potential kernel panic or localized privilege escalation, as multiple threads concurrently manipulate and release shared resources, such as nfsd_file structures and copy_task task_structs, without sufficient synchronization or reference counting.\nExploitation requires the ability to initiate NFS asynchronous copy operations, making this a network-exposed issue for systems facilitating NFSv4.2 server-to-server or asynchronous copy features.\nThe vulnerability highlights a lack of proper lifetime management for asynchronous objects, necessitating comprehensive fixes in the reference counting and task synchronization logic within the nfsd subsystem.",
  "technicalDetails": "The core of this vulnerability is a race condition between the async copy kthread and the teardown paths (OFFLOAD_CANCEL, nfsd4_shutdown_copy, and nfsd4_cancel_copy_by_sb). The nfsd subsystem failed to ensure atomic lifetime management for 'copy' objects when multiple concurrent processes accessed them.\nMultiple specific scenarios exacerbate this condition:\n1. Inconsistent list management: The find_async_copy() function would increment the reference count but leave the copy object in the clp->async_copies list. This enabled the reaper (cleanup_async_copy()) to execute release_copy_files() while a teardown path was simultaneously performing the same cleanup, leading to double-free conditions of nf_src/nf_dst structures.\n2. Improper task control: The nfsd4_do_async_copy() function set the NFSD4_COPY_F_STOPPED flag before the final usage of the copy objects. Since nfsd4_stop_copy() treats this flag as a signal that the kthread has finished, the teardown logic proceeded to release resources (nf_dst) while the kthread was still actively dereferencing them, resulting in a UAF.\n3. Dangling references to task_struct: The copy->copy_task pointer was not properly pinned. Because the one-shot kthread performs self-reaping upon completion, calls to kthread_stop() could result in an attempt to access a freed task_struct.\n4. Incomplete Callback lifecycle: The co_cb member, embedded within the copy structure, was handled without a sufficient reference to the parent copy object during CB_OFFLOAD callbacks. A concurrent teardown could free the entire copy structure while an in-flight callback attempted to reference it.\nAttackers can exploit this by triggering rapid sequences of asynchronous copy requests followed by immediate cancellation signals. By orchestrating these requests, an attacker forces the kernel into a state where the memory management logic assumes an object is safe to free while it remains on the internal wait-queues or is being accessed by a kthread. The impact involves memory corruption via UAF, which can be leveraged to destabilize the kernel or, theoretically, achieve arbitrary code execution within the kernel context. The fix involves implementing proper reference counting (nfs4_put_copy), unlinking the object from lists under the async_lock before teardown, and ensuring proper task_struct pinning using get_task_struct() to guarantee that the kthread lifecycle is strictly managed and synchronized with object destruction."
}