CVE-2021-47166

What it actually does

The NFS page coalescing logic in nfs_do_recoalesce() incorrectly updates mirror->pg_bytes_written before verifying that pending requests on the list can be flushed, allowing memory corruption of page accounting values.

Why it matters to the business

Systems relying on NFS may experience kernel instability, crashes, or data handling errors during file operations, potentially disrupting storage access and requiring restarts or maintenance windows.

How an attack unfolds

An attacker with the ability to trigger NFS write coalescing under specific failure conditions can cause the premature update of pg_bytes_written, leading to subsequent memory corruption that may be leveraged for denial of service or further kernel exploitation.

How to fix it

Apply the upstream kernel patch that moves the pg_bytes_written update to occur only after a successful flush in nfs_do_recoalesce(). Rebuild and deploy the fixed kernel across all affected Linux distributions.

How to confirm the fix worked

Confirm the presence of the commit message 'NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()' in the running kernel source or verify the corrected update logic via code review or kernel binary diffing.

Typical attack path

1. Gain local or network access to a system using NFS
2. Induce conditions that cause nfs_do_recoalesce() to fail flushing requests
3. Trigger repeated coalescing operations to corrupt pg_bytes_written
4. Escalate the resulting memory corruption into a crash or code execution primitive

How to detect it

Search kernel logs for NFS page write or coalescing related panics and oops around the time of NFS activity; examine dmesg and syslog for corruption indicators tied to pg_bytes_written.

What your security team should do

• Prioritize kernel updates on all NFS clients and servers within standard change windows
• Monitor for NFS-related kernel oops or panic reports as indicators of potential exposure
• Review NFS workload patterns for high coalescing activity that could surface the bug