In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix use-after-free due to delegation race
A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the delegation to del_recall_lru. If we then exit nfs4_set_delegation without hashing the delegation, it will be freed as soon as the callback is done with it, without ever being removed from del_recall_lru.
Symptoms show up later as use-after-free or list corruption warnings, usually in the laundromat thread.
I suspect aba2072f4523 "nfsd: grant read delegations to clients holding writes" made this bug easier to hit, but I looked as far back as v3.0 and it looks to me it already had the same problem. So I'm not sure where the bug was introduced; it may have been there from the beginning.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernelUpgrade kernel-livepatch-4.14.262-200.489Upgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.93-87.444Upgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade python-perfUpgrade bpftoolUpgrade python-perf-debuginfo | Feb 3, 2025 | May 24, 2024 |
| Amazon_linux | — | Upgrade kernel | Jan 31, 2025 | Feb 8, 2022 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Dell Powerstore Dsa2024462 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Nov 20, 2024 |
| Dell Powerstore Dsa2024497 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Dec 19, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 24, 2024 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade kernel-source-vanillaUpgrade dtb-lgUpgrade kernel-preemptUpgrade kernel-source-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-extraUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-azure-develUpgrade dtb-nvidiaUpgrade kernel-rt-vdsoUpgrade kernel-rt_debug-vdsoUpgrade kernel-sourceUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-rockchipUpgrade kernel-docsUpgrade cluster-md-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-default-manUpgrade kernel-azure-extraUpgrade kernel-source-rtUpgrade kernel-docs-htmlUpgrade kernel-rt-optionalUpgrade kernel-rtUpgrade kernel-default-extraUpgrade dtb-broadcomUpgrade cluster-md-kmp-defaultUpgrade dtb-socionextUpgrade kernel-azure-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-obs-buildUpgrade dtb-freescaleUpgrade kernel-kvmsmall-vdsoUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-develUpgrade dtb-marvellUpgrade dtb-qcomUpgrade kernel-syms-azureUpgrade dtb-exynosUpgrade kernel-syms-rtUpgrade kernel-rt_debug-develUpgrade dtb-amlogicUpgrade kernel-debug-vdsoUpgrade kernel-azure-baseUpgrade gfs2-kmp-defaultUpgrade kernel-symsUpgrade dtb-renesasUpgrade cluster-md-kmp-64kbUpgrade dtb-caviumUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-livepatchUpgrade kernel-preempt-develUpgrade kernel-default-vdsoUpgrade kernel-develUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-default-develUpgrade dtb-xilinxUpgrade dlm-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-sprdUpgrade kernel-default-optionalUpgrade kernel-default-baseUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-devel-rtUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-defaultUpgrade dtb-hisiliconUpgrade dlm-kmp-64kbUpgrade kernel-rt-develUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-azureUpgrade dtb-alteraUpgrade dtb-amdUpgrade dtb-armUpgrade cluster-md-kmp-rtUpgrade kernel-azure-optionalUpgrade kernel-defaultUpgrade kernel-64kb-livepatch-develUpgrade dtb-allwinnerUpgrade kernel-64kb-develUpgrade kernel-64kbUpgrade kselftests-kmp-rtUpgrade dtb-appleUpgrade dtb-amazonUpgrade dtb-mediatek | Aug 9, 2024 | May 24, 2024 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-4.4.0-268-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-genericUpgrade linux-image-4.4.0-1181-awsUpgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-1143-awsUpgrade linux-image-awsUpgrade linux-image-fipsUpgrade linux-image-generic-lts-xenialUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-virtualUpgrade linux-image-4.4.0-268-generic | Nov 19, 2024 | May 24, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub