Description

In the Linux kernel, the following vulnerability has been resolved: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with list_for_each_entry_safe(ni, tmp, ...). For each expired entry it sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the source vfsmount, then reacquires the lock to list_del + kfree the entry and continue iterating via the macro's saved tmp pointer. The nsui_busy flag protects the current ni from concurrent nfsd4_ssc_setup_dul() finders during the lock-drop window, but it does not pin tmp. Another nfsd RPC thread that fails its source- server mount and reaches nfsd4_ssc_cancel_dul() will, during that same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount item, and release the lock. If that item is the saved tmp of the expire walk, the next iteration dereferences a freed nfsd4_ssc_umount_item. Restart the walk from the head after the mntput() unlock window so no saved next pointer survives the lock-drop. The list is bounded by the number of active inter-server source mounts (typically small) and the expire delayed-work runs periodically rather than per-IO, so the restart is cheap.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:58.620Z",
  "pubdate": "2026-09-11T20:19:58.620Z",
  "executiveSummary": "This vulnerability is a Use-After-Free (UAF) flaw residing in the Linux kernel's NFSD (NFS server) subsystem, specifically within the inter-server copy (SSC) mount management logic.\nThe issue arises from unsafe iteration patterns during the cleanup of expired mount items within the nfsd_ssc_mount_list.\nIf an attacker or a competing system process triggers a concurrent removal of a mount item while an expiration walk is suspended, the kernel may attempt to dereference a memory address that has already been freed.\nThe impact includes potential kernel memory corruption, system instability, or local denial-of-service (DoS) conditions.\nThe flaw affects the NFSD subsystem in kernel versions where inter-server copy functionality is implemented. Exploitation requires the kernel to be running with NFS server functionality enabled and requires specific timing conditions where an expiration task and a cancellation task operate on the same list elements simultaneously.\nWhile no specific network-level exploit payload is required to trigger the underlying bug, it remains a kernel-level security concern that necessitates prompt patching to maintain system integrity.",
  "technicalDetails": "The root cause is a race condition involving the nfsd_ssc_mount_list iteration in nfsd4_ssc_expire_umount(). The function employs the list_for_each_entry_safe() macro to iterate through mount objects. During this process, the code drops the nfsd_ssc_lock mutex to perform an mntput() operation on a vfsmount object, intended to avoid holding the lock during potentially blocking operations.\nThe vulnerability stems from the fact that list_for_each_entry_safe() caches the 'next' pointer (stored in the 'tmp' variable) before executing the loop body. When the lock is dropped and then re-acquired, the system expects the 'tmp' pointer to remain valid. However, another kernel thread executing nfsd4_ssc_cancel_dul() may acquire the nfsd_ssc_lock, perform a list_del() on the object pointed to by 'tmp', and subsequently kfree() that memory.\nWhen the original thread resumes execution after re-acquiring the nfsd_ssc_lock, it continues the iteration using the stale, now-freed 'tmp' pointer. Dereferencing this pointer triggers a Use-After-Free condition. This vulnerability essentially involves a failure to re-validate list pointers after a critical section gap created by dropping the global lock.\nThe attack flow follows these steps: 1) The nfsd4_ssc_expire_umount function identifies an expired entry, sets nsui_busy, and drops nfsd_ssc_lock. 2) A concurrent thread executing nfsd4_ssc_cancel_dul removes and frees the object designated as the 'next' element in the iteration. 3) The nfsd4_ssc_expire_umount function re-acquires the lock and attempts to reference the freed memory address of the removed list object. 4) The kernel experiences a memory access violation or unpredictable behavior due to the invalidated object.\nThe vulnerability is localized to the NFSD inter-server copy management logic. Because the nfsd_ssc_mount_list is typically small and the expiration work is scheduled periodically, the risk of exploitation is tied to the concurrency of the expiration process and the dynamic cancellation of mount tasks. Mitigation requires changing the list traversal strategy to avoid relying on cached pointers across points where locks are released and re-acquired, specifically by restarting the traversal from the list head."
}