Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() dentry_create() can hypothetically provide a different dentry than the one passed in. This could happen, for example, if the exported filesystem is NFS, and the server returned to OPEN a filehandle which matched a directory that was already in the dcache. Clearly this would not be expected! If this were to happen the dentry (child) that was already stored in resfhp could be freed and later dereferenced. We shouldn't call fh_compose() until we are certain that we have the final dentry, so this patch moved the fh_compose() call to two places: one for the case where the target already exists, and one after dentry_create() where it was created.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:54.393Z",
  "pubdate": "2026-09-11T20:19:54.393Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists in the Linux kernel's nfsd implementation within the nfsd4_create_file() function. The flaw is triggered by a race condition or mismatch during dentry creation when the underlying exported filesystem is an NFS mount. This vulnerability allows for memory corruption and potential system instability or arbitrary code execution by an attacker capable of manipulating NFS filehandle resolution. The vulnerability affects the nfsd subsystem, specifically impacting file creation operations. The primary risk is a potential kernel panic or malicious exploitation of a dereferenced pointer, leading to a compromised system state. Successful exploitation requires the attacker to influence the dcache state, typically by triggering specific filehandle lookups that result in dentry replacement during the file creation process.",
  "technicalDetails": "The vulnerability resides in the interaction between nfsd4_create_file() and the underlying dentry management subsystem. In the original implementation, the kernel performed an fh_compose() operation on a dentry before ensuring that the dentry returned by dentry_create() was indeed the finalized object. If the filesystem being exported is itself an NFS mount, the kernel may return a different dentry than the one initially provided if the filehandle matches an object already residing in the dentry cache (dcache).\nThe root cause is premature finalization of the filehandle via fh_compose(). When dentry_create() is invoked, it may perform an internal lookup or revalidation that results in the original dentry being discarded or replaced. Because the previous implementation of nfsd4_create_file() had already stored the initial dentry in the result filehandle structure (resfhp), a mismatch causes the kernel to retain a reference to a dentry that may be subject to free-upon-failure or substitution. Subsequent operations then attempt to access this stale dentry pointer, leading to a Use-After-Free scenario.\nThe exploitation flow proceeds as follows: 1) An attacker initiates an NFS file creation request (OPEN) targeting a specific path. 2) The nfsd subsystem triggers a dentry lookup that forces a dcache hit for an existing, conflicting entry. 3) dentry_create() performs the necessary filesystem-level actions, potentially returning a different dentry object than expected. 4) The kernel, having already executed fh_compose() on the stale dentry, proceeds with the process using an invalid pointer. 5) When the kernel later dereferences this pointer—for instance, during subsequent nfsd request processing or cleanup—it triggers a Use-After-Free condition.\nThis vulnerability is critical because it occurs at the kernel level, potentially granting an unprivileged or remote attacker the ability to trigger a kernel panic (Denial of Service) or, through advanced heap grooming techniques, achieve arbitrary code execution. The reliance on the dcache state implies that an attacker needs to carefully stage the environment, likely requiring knowledge of the exported filesystem layout and the ability to influence the dcache through specific sequences of NFS operations."
}