In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix RELEASE_LOCKOWNER
The test on so_count in nfsd4_release_lockowner() is nonsense and harmful. Revert to using check_for_locks(), changing that to not sleep.
First: harmful. As is documented in the kdoc comment for nfsd4_release_lockowner(), the test on so_count can transiently return a false positive resulting in a return of NFS4ERR_LOCKS_HELD when in fact no locks are held. This is clearly a protocol violation and with the Linux NFS client it can cause incorrect behaviour.
If RELEASE_LOCKOWNER is sent while some other thread is still processing a LOCK request which failed because, at the time that request was received, the given owner held a conflicting lock, then the nfsd thread processing that LOCK request can hold a reference (conflock) to the lock owner that causes nfsd4_release_lockowner() to return an incorrect error.
The Linux NFS client ignores that NFS4ERR_LOCKS_HELD error because it never sends NFS4_RELEASE_LOCKOWNER without first releasing any locks, so it knows that the error is impossible. It assumes the lock owner was in fact released so it feels free to use the same lock owner identifier in some later locking request.
When it does reuse a lock owner identifier for which a previous RELEASE failed, it will naturally use a lock_seqid of zero. However the server, which didn't release the lock owner, will expect a larger lock_seqid and so will respond with NFS4ERR_BAD_SEQID.
So clearly it is harmful to allow a false positive, which testing so_count allows.
The test is nonsense because ... well... it doesn't mean anything.
so_count is the sum of three different counts. 1/ the set of states listed on so_stateids 2/ the set of active vfs locks owned by any of those states 3/ various transient counts such as for conflicting locks.
When it is tested against '2' it is clear that one of these is the transient reference obtained by find_lockowner_str_locked(). It is not clear what the other one is expected to be.
In practice, the count is often 2 because there is precisely one state on so_stateids. If there were more, this would fail.
In my testing I see two circumstances when RELEASE_LOCKOWNER is called. In one case, CLOSE is called before RELEASE_LOCKOWNER. That results in all the lock states being removed, and so the lockowner being discarded (it is removed when there are no more references which usually happens when the lock state is discarded). When nfsd4_release_lockowner() finds that the lock owner doesn't exist, it returns success.
The other case shows an so_count of '2' and precisely one state listed in so_stateid. It appears that the Linux client uses a separate lock owner for each file resulting in one lock state per lock owner, so this test on '2' is safe. For another client it might not be safe.
So this patch changes check_for_locks() to use the (newish) find_any_file_locked() so that it doesn't take a reference on the nfs4_file and so never calls nfsd_file_put(), and so never sleeps. With this check is it safe to restore the use of check_for_locks() rather than testing so_count against the mysterious '2'.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-zfcpdump-coreUpgrade kernel-rt-develUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-zfcpdump-modulesUpgrade bpftoolUpgrade perfUpgrade kernel-uki-virtUpgrade kernel-docUpgrade kernel-rt-modulesUpgrade kernel-toolsUpgrade kernel-64k-debug-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rtUpgrade rvUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debugUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-64k-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-develUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-modules-extraUpgrade kernel-64k-develUpgrade kernel-debug-coreUpgrade kernel-headersUpgrade kernel-64k-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade rtlaUpgrade kernel-debugUpgrade kernel-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-cross-headersUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64kUpgrade kernel-64k-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-coreUpgrade kernel-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdump-develUpgrade kernel-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-debug-uki-virtUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-devel-matchedUpgrade kernel-64k-modules-coreUpgrade kernelUpgrade libperfUpgrade kernel-debug-modulesUpgrade kernel-coreUpgrade kernel-tools-libs | Nov 4, 2024 | Mar 13, 2024 |
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-livepatch-5.15.156-102.160Upgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-livepatch-5.10.220-209.867Upgrade kernel-tools-develUpgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-devel | Jul 9, 2024 | Mar 13, 2024 |
| Amazon_linux_2023 | — | Upgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade kernel-headersUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-libbpf-staticUpgrade bpftoolUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-livepatch-6.1.79-99.164Upgrade kernel-develUpgrade perfUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfo | Feb 17, 2025 | Mar 13, 2024 |
| Debian | — | Upgrade linux | Jul 17, 2024 | Mar 13, 2024 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Mar 13, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Dec 5, 2024 | Mar 13, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-kvmUpgrade kernel-cross-headersUpgrade kernelUpgrade kernel-rt-coreUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debugUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debuginfoUpgrade rtlaUpgrade kernel-rt-develUpgrade kernel-rt-debug-coreUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade libperf-debuginfoUpgrade kernel-tools-libsUpgrade kernel-tools-libs-develUpgrade kernel-debug-modulesUpgrade kernel-debug-modules-coreUpgrade python3-perfUpgrade kernel-rt-debuginfoUpgrade kernel-uki-virtUpgrade kernel-develUpgrade perf-debuginfoUpgrade kernel-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rtUpgrade kernel-coreUpgrade kernel-zfcpdump-modulesUpgrade rvUpgrade kernel-zfcpdump-modules-extraUpgrade libperfUpgrade kernel-rt-debug-develUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-headersUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-develUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-toolsUpgrade kernel-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-debug-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-modules-coreUpgrade kernel-devel-matched | Sep 17, 2024 | Mar 13, 2024 |
| Suse | — | Upgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade dtb-marvellUpgrade gfs2-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-64kbUpgrade kernel-rtUpgrade dlm-kmp-64kbUpgrade dtb-socionextUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-develUpgrade dtb-exynosUpgrade dtb-sprdUpgrade cluster-md-kmp-64kbUpgrade dtb-lgUpgrade dtb-freescaleUpgrade kernel-azure-develUpgrade kselftests-kmp-azureUpgrade kernel-azure-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatchUpgrade kernel-rt-optionalUpgrade kernel-rt_debug-develUpgrade cluster-md-kmp-azureUpgrade kernel-rt-extraUpgrade dtb-amdUpgrade dtb-amazonUpgrade kernel-rt_debugUpgrade dlm-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-azureUpgrade kernel-docs-htmlUpgrade kernel-obs-buildUpgrade kselftests-kmp-64kbUpgrade kernel-source-rtUpgrade dtb-broadcomUpgrade dtb-caviumUpgrade ocfs2-kmp-defaultUpgrade kernel-sourceUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-source-vanillaUpgrade dtb-alteraUpgrade kernel-source-azureUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-macrosUpgrade dtb-nvidiaUpgrade kselftests-kmp-rtUpgrade kernel-debug-livepatch-develUpgrade kernel-syms-azureUpgrade dtb-renesasUpgrade cluster-md-kmp-defaultUpgrade kernel-defaultUpgrade dtb-xilinxUpgrade dlm-kmp-azureUpgrade kernel-develUpgrade kernel-default-base-rebuildUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade kernel-default-optionalUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-azureUpgrade dtb-rockchipUpgrade dlm-kmp-defaultUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade kernel-devel-rtUpgrade kernel-rt-develUpgrade kernel-kvmsmall-develUpgrade dtb-apmUpgrade kernel-64kb-develUpgrade cluster-md-kmp-rtUpgrade kernel-obs-qaUpgrade dtb-amlogicUpgrade kernel-symsUpgrade kselftests-kmp-defaultUpgrade dtb-mediatekUpgrade dtb-armUpgrade reiserfs-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-rt-livepatchUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade ocfs2-kmp-azureUpgrade kernel-debug-develUpgrade kernel-64kb-optionalUpgrade kernel-default-extraUpgrade ocfs2-kmp-rtUpgrade kernel-docsUpgrade kernel-default-baseUpgrade gfs2-kmp-64kbUpgrade dtb-qcomUpgrade dtb-hisilicon | Apr 18, 2024 | Mar 13, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-oem-22.04aUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-gkeUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oracleUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-nvidiaUpgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-intelUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-gkeopUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-genericUpgrade linux-image-oem-20.04Upgrade linux-image-ibmUpgrade linux-image-virtualUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-gke-5.15Upgrade linux-image-oem-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.5.0-1022-azureUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-laptop-23.10Upgrade linux-image-6.5.0-41-genericUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-azureUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-6.5Upgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-oem-20.04dUpgrade linux-image-kvmUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-starfiveUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-5.15.0-116-genericUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-oem-22.04bUpgrade linux-image-awsUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-aws-lts-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-nvidia-64k-6.5Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-azure-cvmUpgrade linux-image-intel-iotg | May 17, 2024 | Mar 13, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Mar 13, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub