Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsd_net boolean flags to unsigned long flags word nfsd_net contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4_end_grace() guards its drain path with a plain bool: if (nn->grace_ended) return; nn->grace_ended = true; The read and the write are independent, and nothing in struct nfsd_net serializes them. At least two contexts can reach this code with no lock held: laundromat path laundry_wq kworker nfs4_laundromat() nfsd4_end_grace() RECLAIM_COMPLETE path nfsd compound kthread nfsd4_reclaim_complete() inc_reclaim_complete() nfsd4_end_grace() Both callers can observe grace_ended == false on different CPUs, both store true, and both proceed into nfsd4_record_grace_done(), which invokes the active client_tracking_ops->grace_done callback. For tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops via nfsd4_recdir_purge_old, and the cld v1+ ops via nfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(), which walks every bucket of reclaim_str_hashtbl with no lock and calls nfs4_remove_reclaim_record() (list_del + kfree) on each entry. Two concurrent walkers corrupt the list and double-free every nfs4_client_reclaim. A concurrent nfsd4_find_reclaim_client() iterating the same bucket reads through freed memory. A third call site exists in nfs4_state_start_net() on the skip_grace startup path, but it runs under nfsd_mutex before any client has connected and before the laundromat's first delayed work fires, so it cannot race with the two callers above. Replace the scattered boolean fields in nfsd_net with a single unsigned long flags word and an enum nfsd_net_flag for the bit positions. The grace_ended race is fixed by using test_and_set_bit(), which is atomic on all architectures. The remaining flags (grace_end_forced, in_grace, somebody_reclaimed, track_reclaim_completes, nfsd_net_up, lockd_up) are converted to use test_bit/set_bit/clear_bit for consistency. This avoids sub-word cmpxchg issues on architectures like Hexagon that only support word-sized atomic operations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-24T16:17:17.310Z",
  "pubdate": "2026-09-24T16:17:17.310Z",
  "executiveSummary": "A race condition vulnerability exists in the Linux kernel's nfsd subsystem, specifically involving the management of grace period flags within the nfsd_net structure.\nThe vulnerability stems from the use of non-atomic boolean flags to track the grace period state, which are accessed concurrently by multiple kernel execution paths without proper serialization.\nThe primary impact is memory corruption, specifically list corruption and double-free vulnerabilities involving nfs4_client_reclaim objects, which can lead to system instability, kernel panics, or potentially exploitable use-after-free scenarios.\nThe issue affects systems utilizing the NFSD (Network File System Daemon) service, particularly during the transition out of the grace period.\nExploitation requires triggering concurrent calls to nfsd4_end_grace() via the laundromat worker and the RECLAIM_COMPLETE processing path. Successful exploitation may allow an attacker to disrupt NFS services or potentially achieve arbitrary code execution via memory corruption primitives if they can reliably manipulate the kernel heap.",
  "technicalDetails": "The root cause of this vulnerability is the lack of atomic synchronization for boolean flags within the nfsd_net structure, which governs NFSv4 grace period operations. Specifically, the grace_ended boolean is checked and set across multiple execution contexts—the laundromat thread (laundry_wq) and the nfsd compound kthread (via nfsd4_reclaim_complete)—without the protection of a mutex or atomic primitives.\nIn a race condition scenario, both the laundromat path and the RECLAIM_COMPLETE path can simultaneously observe grace_ended as 'false'. Consequently, both execution threads proceed to trigger nfsd4_record_grace_done(). This function subsequently invokes the grace_done callback defined in client_tracking_ops.\nFor legacy and cld-based tracking operations, this callback executes nfs4_release_reclaim(), which iterates through the reclaim_str_hashtbl to remove and free nfs4_client_reclaim entries using list_del and kfree. Because this walk occurs without serialization, two concurrent threads attempting to free the same entries result in list corruption and multiple attempts to kfree the same memory block (double-free).\nFurthermore, a concurrent call to nfsd4_find_reclaim_client() may attempt to traverse the same hash bucket list while it is being concurrently modified and freed. This leads to a use-after-free scenario where the kernel reads from memory that has already been returned to the allocator. This exposes the kernel to potential heap spraying or exploitation of dangling pointers, which could be leveraged to gain elevated privileges or force a system crash.\nThe vulnerability was addressed by migrating the scattered boolean flags within nfsd_net into a single unsigned long flags word. This transformation allows the use of atomic bitwise operations such as test_and_set_bit(), which effectively serializes the grace period state transitions across all concurrent CPU contexts, preventing the race condition from manifesting."
}