HIGH
nfsd Localio UAF
CVE-2026-89670
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: nfsd: hold rcu across localio cmpxchg retry nfsd_file objects are freed via call_rcu (filecache.c:296), and nfsd_file_slab is created without SLAB_TYPESAFE_BY_RCU (KMEM_CACHE(nfsd_file, 0) at filecache.c:789), so the slab page backing a freed nfsd_file becomes freely reclaimable once the RCU grace period elapses. The again: retry block in nfsd_open_local_fh() loads a pointer with cmpxchg and then calls nfsd_file_get(new) (which is refcount_inc_not_zero) without holding rcu_read_lock. The sole caller nfs_open_local_fh() drops rcu_read_lock before invoking this helper, so no outer reader-side critical section covers the load. CPU 0 (nfsd_open_local_fh) CPU 1 (nfsd_file_put_local) ----- ----- new = cmpxchg(pnf, NULL, ...) nf = xchg(pnf, NULL) nfsd_file_put(nf) last ref -> call_rcu() /* grace period elapses; slab page recycled */ nfsd_file_get(new) refcount_inc_not_zero(&new->nf_ref) /* operates on recycled memory */ A non-zero word at the nf_ref offset of the recycled object makes the refcount bump appear to succeed, and the caller then dereferences new->nf_net and new->nf_file out of freed memory. Fix by taking rcu_read_lock() immediately before the cmpxchg and releasing it on all three exits of the if (new) block: the goto-again retry, the lost-race cleanup path, and the install-succeeded path. nfsd_file_put() and nfsd_net_put() stay outside the RCU section so they remain free to block.
02KernelScan AI Analysis
Risk summary
A local user with access to a same-host NFS mount can trigger a use-after-free in the NFS server's localio shortcut, potentially leading to kernel memory corruption, privilege escalation, or a system crash. The vulnerability requires an active NFS configuration where client and server are co-located, and exploitation depends on winning a race condition. Systems without NFS, or with no means for users to log in locally or remotely, are not at risk.
Vulnerability analysis
The NFS server's localio shortcut — which lets a co-located NFS client bypass the network and open files directly through the server — can access a cached file object after it has been freed. A retry loop fetches a pointer to a cached file handle and tries to increment its reference count, but does so without the read-side protection that prevents the underlying memory from being reclaimed. If another thread concurrently drops the last reference and the grace period elapses in the gap, the retry operates on recycled memory; a coincidentally non-zero value where the reference count was stored makes the increment appear to succeed, and the caller then dereferences freed fields. The fix wraps the pointer fetch and reference-count increment in the missing protection so the memory page cannot be reclaimed until the reference is safely acquired. The vulnerable path is reachable locally by any user accessing files on a locally-mounted NFS filesystem where the client and server share the same host; it requires no special privileges beyond the ability to perform file I/O on such a mount, though the NFS mount itself must already be configured by an administrator.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.15 | 6.15.3 | 6.16 | 763c0bad8723 |
| 6.18 | — | 6.18.50 | 559570f91a7d |
| 7.2 | — | 7.2.4 | 58884694978a |
| mainline | — | 7.3-rc1 | — |