Description

In the Linux kernel, the following vulnerability has been resolved: nfsd: add missing read barrier to rpc_status_get dumpit seqcount retry The hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit() is missing a read memory barrier (smp_rmb) before its second counter check. The standard kernel read_seqcount_retry() includes smp_rmb() to ensure that all data reads complete before the counter is re-checked. Without this barrier, on weakly-ordered architectures (ARM, POWER), the CPU may reorder field reads past the second counter check, making the retry logic ineffective: it could observe a consistent counter pair while reading fields that have been concurrently modified by the writer. Add smp_rmb() before the second counter check to order the field reads ahead of it, matching the barrier semantics of the standard seqcount read-side. The begin-side smp_load_acquire() already pairs with the smp_store_release() in nfsd_dispatch(); with the smp_rmb() now ordering the field reads, the retry check no longer needs acquire semantics and reads the counter with a plain READ_ONCE(), as read_seqcount_retry() does. [ cel: Use READ_ONCE instead of smp_load_acquire() ]

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-24T16:17:18.387Z",
  "pubdate": "2026-09-24T16:17:18.387Z",
  "executiveSummary": "A race condition vulnerability exists within the nfsd_nl_rpc_status_get_dumpit() function of the Linux kernel due to an improperly implemented synchronization primitive.\nThe vulnerability involves a missing read memory barrier in a custom seqcount-like protocol, which fails to guarantee the consistency of data reads on weakly-ordered CPU architectures.\nImpact includes potential memory corruption or the retrieval of inconsistent/corrupted RPC status information during concurrent read-write operations.\nAffected systems include Linux kernel instances utilizing nfsd with specific RPC status monitoring enabled.\nExploitation requires an attacker to trigger concurrent access to the affected RPC status structures, potentially leading to a bypass of the intended retry logic, allowing the observer to read a state that appears consistent but contains stale or partially updated data.\nWhile this is primarily an internal kernel-level synchronization issue, it could be leveraged by local attackers to destabilize the kernel or extract sensitive telemetry data.",
  "technicalDetails": "The vulnerability resides in the custom implementation of a seqcount-like synchronization mechanism within nfsd_nl_rpc_status_get_dumpit(). In the Linux kernel, seqcount patterns are used to provide lightweight synchronization for read-side access to shared data structures.\nThe root cause is the absence of an smp_rmb() (read memory barrier) before the second counter check. On weakly-ordered architectures such as ARM and POWER, CPUs are permitted to perform speculative loads or reorder memory operations for optimization purposes.\nWithout the explicit smp_rmb(), the CPU may execute the reads of the RPC status fields after the second counter check, effectively breaking the atomicity guarantee of the seqcount pattern. This allows the logic to observe a pair of sequence counter values that match, suggesting a consistent read, even when the underlying data fields were modified by a concurrent writer during the read window.\nThe exploitation flow begins with a thread invoking nfsd_nl_rpc_status_get_dumpit() to retrieve RPC status telemetry. Simultaneously, a writer thread updates the shared status structures, incrementing the sequence counter. If the reader thread fails to observe the change in the counter due to instruction reordering, it proceeds under the false assumption that it has captured a consistent snapshot of the data.\nThe vulnerability effectively bypasses the retry logic, enabling an attacker to read partially updated memory state. This could lead to undefined behavior, kernel crashes, or the reporting of inaccurate status information if the read structure contains pointers or complex state metadata. The fix involves inserting an smp_rmb() before the second counter check to ensure that all data reads are completed before the counter validation, and switching the initial counter load to READ_ONCE to strictly adhere to kernel memory consistency models.\nThe component affected is the nfsd (NFS server) subsystem's RPC status dump functionality. Because this mechanism acts as a synchronization primitive, the failure is architecture-dependent and most critical on systems where memory visibility is not strictly enforced by the hardware for un-fenced loads."
}