CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's NFSv4.0 implementation, specifically in the handling of client state during revoked-state cleanup, which can lead to a use-after-free condition. This flaw may allow an attacker to exploit race conditions, potentially leading to system instability or unauthorized access. Organizations using Linux-based systems that rely on NFSv4.0 should prioritize patching this vulnerability to mitigate risks associated with client state management.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup nfs40_clean_admin_revoked() takes a stateid reference under clp->cl_lock, drops nn->client_lock, and calls nfsd4_drop_revoked_stid(), which dereferences the stateid's client through s->sc_client->cl_lock. The stateid reference does not pin the client, so a teardown racing the dropped lock can free the client while nfsd4_drop_revoked_stid() is still using it. This cleanup runs from the laundromat, so a periodic sweep can race force_expire_client() driven by a write to the clients/<id>/ctl file. Skip a client that is already expiring and otherwise pin it with cl_rpc_users under client_lock before dropping the lock, matching nfsd4_revoke_states().