Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: don't free session slots that are still in use nfsd4_sequence() can free the very slot it is currently processing. When the session shrinker has reduced se_target_maxslots below se_fchannel.maxreqs, the shrink path checks three conditions before calling free_session_slots(): 1. se_target_maxslots < maxreqs (shrink was advertised) 2. slot->sl_generation == se_slot_gen (slot is up-to-date) 3. seq->maxslots <= se_target_maxslots (client acknowledges) However, seq->slotid is never checked against se_target_maxslots. A client using a slot in the range [se_target_maxslots, maxreqs) can satisfy all three conditions: its slot has the current generation (set by a prior SEQUENCE), and it sends sa_highest_slotid <= se_target_maxslots to acknowledge the reduction. free_session_slots() then kfrees every slot at index >= se_target_maxslots, including the caller's own slot. The function continues to write sl_seqid, sl_flags, sl_generation, and stores the dangling pointer in cstate->slot. Later, nfsd4_store_cache_entry() copies up to maxresp_cached bytes of the compound reply into the freed sl_data[] array, corrupting whatever slab object now occupies that address. Additionally, a concurrent thread processing SEQUENCE on a different high-numbered slot can have its slot freed out from under it. NFSD4_SLOT_INUSE is set under nn->client_lock before the lock is released, so any concurrent thread past SEQUENCE will have its slot marked. However, free_session_slots() does not check NFSD4_SLOT_INUSE before freeing. Fix both problems by: 1. Checking that the current request's slotid is below the shrink boundary. 2. Scanning slots in the to-be-freed range for NFSD4_SLOT_INUSE and deferring the shrink if any are active.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:55.900Z",
  "pubdate": "2026-09-11T20:19:55.900Z",
  "executiveSummary": "This vulnerability is a use-after-free (UAF) flaw within the Linux kernel's nfsd (NFSv4 server) subsystem related to session slot management.\nThe issue arises when the session shrinker logic improperly deallocates session slots that are currently actively being processed by a client or are marked as in-use.\nThe impact includes potential memory corruption, kernel panic, and the possibility of local or remote privilege escalation depending on the attacker's ability to manipulate slab memory allocations.\nThe flaw affects the NFSv4 protocol implementation, specifically the nfsd4_sequence() function and the associated slot management logic.\nAttackers with access to an NFSv4 mount can potentially trigger this condition by manipulating SEQUENCE operations to force a slot shrinkage while slots are actively in use.\nThe risk is categorized as high due to the potential for arbitrary memory corruption and system instability.",
  "technicalDetails": "The root cause of this vulnerability lies in the race condition and logic failure within the nfsd4_sequence() function and its interaction with the session shrinker. The shrinker attempts to reduce the number of slots in an NFSv4 session, but it fails to adequately validate if the slot being processed by the current thread or any other concurrent thread falls within the range of slots slated for deallocation.\nWhen the shrinker initiates, it checks the target maximum slots against the existing maxreqs. However, it fails to verify that the request's specific slot ID is below the new shrink boundary. A remote client can craft a SEQUENCE operation using a slot ID that is currently valid but falls within the range destined to be freed. Because the server does not enforce this boundary, free_session_slots() proceeds to invoke kfree() on memory that is still actively referenced by the current execution context.\nFollowing the erroneous kfree(), the function continues to operate on the dangling pointer, writing metadata such as sl_seqid, sl_flags, and sl_generation into memory that may have already been reclaimed by the slab allocator. Subsequently, nfsd4_store_cache_entry() attempts to write the compound reply data into the freed sl_data[] buffer. This results in direct memory corruption of whatever slab object has been reassigned to that address by the kernel heap allocator.\nFurthermore, the vulnerability is compounded by a lack of synchronization with the NFSD4_SLOT_INUSE flag. The free_session_slots() function performs its cleanup without verifying if other concurrent threads are currently utilizing slots in the target range. An attacker can initiate a SEQUENCE operation on a high-numbered slot, while simultaneously triggering the shrinker logic on another core. The shrinker will free the active slot, leaving the concurrent thread with a dangling pointer.\nThe exploitation flow typically involves: 1) Establishing an NFSv4 session; 2) Manipulating the session parameters to advertise a shrink; 3) Simultaneously issuing a SEQUENCE request using a high-numbered slot to ensure it is active; 4) Inducing the shrinker to deallocate the slot in use. The post-exploitation impact allows for controlled heap corruption, which can be leveraged to overwrite sensitive kernel objects, potentially leading to arbitrary code execution or kernel privilege escalation."
}