In the Linux kernel, the following vulnerability has been resolved:
nfsd: release svc_expkey/svc_export with rcu_work
The last reference for `cache_head` can be reduced to zero in `c_show` and `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently, `svc_export_put` and `expkey_put` will be invoked, leading to two issues:
1. The `svc_export_put` will directly free ex_uuid. However, `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can trigger a use-after-free issue, shown below.
================================================================== BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd] Read of size 1 at addr ff11000010fdc120 by task cat/870
CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_address_description.constprop.0+0x2c/0x3a0 print_report+0xb9/0x280 kasan_report+0xae/0xe0 svc_export_show+0x362/0x430 [nfsd] c_show+0x161/0x390 [sunrpc] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 proc_reg_read+0xe1/0x140 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Allocated by task 830: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc_node_track_caller_noprof+0x1bc/0x400 kmemdup_noprof+0x22/0x50 svc_export_parse+0x8a9/0xb80 [nfsd] cache_do_downcall+0x71/0xa0 [sunrpc] cache_write_procfs+0x8e/0xd0 [sunrpc] proc_reg_write+0xe1/0x140 vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 868: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kfree+0xf3/0x3e0 svc_export_put+0x87/0xb0 [nfsd] cache_purge+0x17f/0x1f0 [sunrpc] nfsd_destroy_serv+0x226/0x2d0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e
2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`. However, `svc_export_put`/`expkey_put` will call path_put, which subsequently triggers a sleeping operation due to the following `dput`.
============================= WARNING: suspicious RCU usage 5.10.0-dirty #141 Not tainted ----------------------------- ... Call Trace: dump_stack+0x9a/0xd0 ___might_sleep+0x231/0x240 dput+0x39/0x600 path_put+0x1b/0x30 svc_export_put+0x17/0x80 e_show+0x1c9/0x200 seq_read_iter+0x63f/0x7c0 seq_read+0x226/0x2d0 vfs_read+0x113/0x2c0 ksys_read+0xc9/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1
Fix these issues by using `rcu_work` to help release `svc_expkey`/`svc_export`. This approach allows for an asynchronous context to invoke `path_put` and also facilitates the freeing of `uuid/exp/key` after an RCU grace period.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-tools-libsUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade python3-perfUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade perfUpgrade kernel-64k-debug-modulesUpgrade kernel-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-debug-develUpgrade kernelUpgrade kernel-cross-headersUpgrade kernel-64k-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-64k-modules-coreUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-uki-virtUpgrade kernel-rt-64k-develUpgrade rtlaUpgrade kernel-modulesUpgrade kernel-docUpgrade kernel-rt-64k-coreUpgrade kernel-debug-uki-virtUpgrade kernel-modules-extraUpgrade kernel-64k-develUpgrade kernel-rt-coreUpgrade kernel-debug-modules-extraUpgrade kernel-64k-modulesUpgrade kernel-rt-64kUpgrade kernel-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-rtUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-64k-debug-coreUpgrade kernel-headersUpgrade kernel-rt-64k-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debugUpgrade kernel-rt-64k-modules-coreUpgrade kernel-toolsUpgrade kernel-zfcpdumpUpgrade libperfUpgrade kernel-rt-64k-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-64kUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modules-coreUpgrade kernel-rt-64k-debugUpgrade kernel-rt-debug-develUpgrade rvUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-modulesUpgrade kernel-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-zfcpdump-core | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linuxNo solution exists | May 15, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftool | Jun 13, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel | Jun 11, 2025 | Dec 27, 2024 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftool | Jul 1, 2025 | Dec 27, 2024 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Dec 27, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Jul 9, 2025 | Dec 27, 2024 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel-zfcpdumpUpgrade kernel-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-debuginfoUpgrade kernel-coreUpgrade perf-debuginfoUpgrade kernel-modules-extra-matchedUpgrade kernel-rt-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-debuginfo-common-s390xUpgrade libperf-debuginfoUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade rvUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-modules-coreUpgrade libperfUpgrade kernel-rtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virtUpgrade kernel-modulesUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-debuginfoUpgrade kernel-debug-develUpgrade python3-perf-debuginfoUpgrade kernel-rt-coreUpgrade kernelUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-develUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debugUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-coreUpgrade rtlaUpgrade kernel-debug-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-debug-uki-virtUpgrade python3-perf | Feb 5, 2026 | Nov 21, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-1015-oemUpgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-oem-24.04Upgrade linux-image-generic-64kUpgrade linux-image-virtualUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-genericUpgrade linux-image-realtimeUpgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-oracleUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-raspiUpgrade linux-image-azureUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-awsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04bUpgrade linux-image-lowlatencyUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-gcp | Feb 20, 2025 | Dec 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub