Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations nfsd4_drop_revoked_stid() handles FREE_STATEID for admin-revoked delegations but does not set SC_STATUS_FREED before releasing cl_lock. revoke_delegation() uses this flag to detect whether FREE_STATEID has already processed the delegation -- without it, the freed delegation is added to cl_revoked via list_add(), producing a use-after-free when cl_revoked is later traversed in __destroy_client(). The SC_STATUS_REVOKED path in nfsd4_free_stateid() (line 7983) already sets SC_STATUS_FREED correctly. Apply the same pattern to the SC_STATUS_ADMIN_REVOKED path in nfsd4_drop_revoked_stid().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:57.537Z",
  "pubdate": "2026-09-11T20:19:57.537Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel's nfsd (NFS server) implementation concerning the management of delegated state identifiers. The vulnerability arises from an improper state transition during the processing of revoked delegations via the FREE_STATEID operation.\nThe vulnerability occurs because nfsd4_drop_revoked_stid fails to set the SC_STATUS_FREED flag when processing admin-revoked delegations. This omission causes an inconsistency where the kernel incorrectly assumes a freed delegation remains eligible for further processing, leading to its inclusion in the cl_revoked list.\nAn unprivileged remote attacker with access to the NFS service could potentially trigger this race condition, leading to kernel memory corruption, system instability, or a crash (denial of service). In specific scenarios, use-after-free vulnerabilities can be leveraged for local privilege escalation or arbitrary code execution, depending on the kernel's memory allocation state. The impact is significant as it affects core kernel memory management within the NFS subsystem, posing a risk to data integrity and system availability.",
  "technicalDetails": "The root cause of this vulnerability is a state machine inconsistency within the nfsd state management subsystem. Specifically, the function nfsd4_drop_revoked_stid, which is responsible for handling the FREE_STATEID operation for admin-revoked delegations, fails to update the delegation's status to SC_STATUS_FREED before releasing the cl_lock spinlock.\nIn the Linux NFS implementation, the SC_STATUS_REVOKED flag is intended to track whether a delegation has already been processed and freed. When revoke_delegation() is invoked, it checks for this flag to determine if the state identifier has been cleared. Because nfsd4_drop_revoked_stid does not set SC_STATUS_FREED, the delegation object is mistakenly treated as still active or pending transition after the function returns.\nThe vulnerability manifests during the cleanup phase of the NFS client lifecycle. When __destroy_client() is called, it traverses the cl_revoked list to perform final reclamation of revoked state identifiers. Because the incorrectly handled delegation was added to this list due to the missing status flag, the kernel attempts to access the memory associated with that delegation object. Since the delegation was already released/freed earlier in the flow, the pointer in the cl_revoked list now references deallocated memory, resulting in a use-after-free condition.\nAn attacker can exploit this by triggering repeated FREE_STATEID operations on admin-revoked delegations while the client state is undergoing destruction. By forcing the kernel to add a freed object to the cl_revoked list, the attacker ensures that the subsequent traversal in __destroy_client() triggers the use-after-free. The exploitation is facilitated by the fact that the kernel does not perform sufficient validation of the state object's metadata before list operations in the client destruction path.\nThis vulnerability is restricted to the NFS server (nfsd) and requires an attacker to interact with the NFS protocol, typically requiring network-level access to the exported file system. Successful exploitation results in memory corruption that can lead to a kernel panic, effectively creating a denial-of-service condition. Because this involves the kernel's slab allocator, the precise side effects are dependent on the memory layout and the kernel's heap hardening features at the time of the crash."
}