EUVD-2026-76598
GHSA-8hmx-j653-mwq6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authenticated NFS client over the network (AV:N/PR:L) must win an asynchronous revoke race (AC:H); impact is a server panic only, so C:N/I:N/A:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
nfsd4_alloc_layout_stateid reads fp->fi_deleg_file without holding fi_lock when the parent stateid is a delegation. A concurrent delegation revoke via the laundromat can clear fi_deleg_file under fi_lock, causing nfsd_file_get() to return NULL and triggering the BUG_ON.
This race is client-reachable: two NFS clients can trigger it by having one hold a delegation while another opens the same file to force a recall. When the first client doesn't respond to the recall, the laundromat revokes it. A concurrent LAYOUTGET from any client using the delegation stateid hits the race window.
Fix this by taking fi_lock around the fi_deleg_file read in the SC_TYPE_DELEG path, matching the locking discipline of the find_any_file() arm, and replacing the BUG_ON with a graceful error return that cleans up the partially-initialized layout stateid.
AnalysisAI
Remote denial of service in the Linux kernel's NFSD pNFS server (NFSv4.1+) lets authenticated NFS clients crash the server by racing a LAYOUTGET against a delegation revoke. nfsd4_alloc_layout_stateid() reads fp->fi_deleg_file without holding fi_lock on the delegation-parent path, so a concurrent laundromat revoke can clear that pointer, making nfsd_file_get() return NULL and triggering a BUG_ON kernel panic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be a Linux host exporting files over NFSv4.1 or later with pNFS layout support enabled (LAYOUTGET reachable). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: update to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or a distribution kernel that backports commits c517f27498757e616d2a8fe6d16caad1fee422e6 / ca94ba36172046be6a694a7986f6931e47ed4d51), which take fi_lock around the fi_deleg_file read and replace the BUG_ON with a graceful error path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux NFS servers to determine which run kernel versions before 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, and verify pNFS/NFSv4.1+ is enabled in NFSD configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today